Red Hat Security AdvisoryRHSA-2022:4797
maven:3.6 security update
Released 2022-05-30 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 8) aopalliance-1.0-20.module+el8.6.0+13337+afcb49ec.noarch::maven:3.6, aopalliance-1.0-20.module+el8.6.0+13337+afcb49ec.src::maven:3.6, apache-commons-cli-1.4-7.module+el8.6.0+13337+afcb49ec.noarch::maven:3.6 +47
- Red Hat Enterprise Linux AppStream EUS (v. 8.2) aopalliance-1.0-20.module+el8.2.0+5557+11a14461.noarch::maven:3.6, aopalliance-1.0-20.module+el8.2.0+5557+11a14461.src::maven:3.6, apache-commons-cli-1.4-7.module+el8.2.0+5557+11a14461.noarch::maven:3.6 +47
- Red Hat Enterprise Linux AppStream EUS (v.8.4) aopalliance-1.0-20.module+el8.3.0+6804+157bd82e.noarch::maven:3.6, aopalliance-1.0-20.module+el8.3.0+6804+157bd82e.src::maven:3.6, apache-commons-cli-1.4-7.module+el8.3.0+6804+157bd82e.noarch::maven:3.6 +47
Fixes 1 record
Priority MEDIUM 49
In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.04423 · Published 2022-05-23 · Partial fix · 3.3.3 CWE-116
