Red Hat Security Advisory

RHSA-2022:1662

rh-maven36-maven-shared-utils security update

Released 2022-05-02 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Software Collections for RHEL Workstation(v. 7) rh-maven36-maven-shared-utils-3.2.1-0.2.3.el7, rh-maven36-maven-shared-utils-javadoc-3.2.1-0.2.3.el7
Red Hat Software Collections for RHEL(v. 7) rh-maven36-maven-shared-utils-3.2.1-0.2.3.el7, rh-maven36-maven-shared-utils-javadoc-3.2.1-0.2.3.el7

Fixes 1 record

TI-2022-12034 CVE-2022-29599 · GHSA-rhgr-952r-6p8q

Commandline class shell injection vulnerabilities

MEDIUM 49

In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04423 Published 2022-05-23 Partial fix · 3.3.3 CWE-116