Red Hat Security Advisory

RHSA-2022:4699

maven:3.5 security update

Released 2022-05-23 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream E4S (v. 8.1) aopalliance-1.0-17.module+el8+2452+b359bfcd.noarch::maven:3.5, aopalliance-1.0-17.module+el8+2452+b359bfcd.src::maven:3.5, apache-commons-cli-1.4-4.module+el8+2452+b359bfcd.noarch::maven:3.5 +47

Fixes 1 record

TI-2022-12034 CVE-2022-29599 · GHSA-rhgr-952r-6p8q

Commandline class shell injection vulnerabilities

MEDIUM 49

In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04423 Published 2022-05-23 Partial fix · 3.3.3 CWE-116