Read the docs
TI-2022-12034 Aliases CVE-2022-29599GHSA-rhgr-952r-6p8q

Commandline class shell injection vulnerabilities

Priority MEDIUM 49CWE-116Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 16 fixed, 7 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-77.

Summary

In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks.

Why it matters now

EPSS 0.04423 91st percentileScored 2026-11-07
Fix Partial Apache Maven (Apache Software Foundation): 3.3.3org.apache.maven.shared:maven-shared-utils (Maven): 3.3.3Red Hat: 18 advisoriesRed Hat: 16 fixed, 7 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Mavenmaven-shared-utils to before 3.3.33.3.3Patch availableCNA
—org.apache.maven.shared:maven-shared-utils (Maven)before 3.3.33.3.3Patch availableGHSA-rhgr-952r-6p8q
  • Apache Maven VendorApache Affected maven-shared-utils to before 3.3.3 Fixed in 3.3.3 Patch available CNA
  • org.apache.maven.shared:maven-shared-utils (Maven) Vendor— Affected before 3.3.3 Fixed in 3.3.3 Patch available GHSA-rhgr-952r-6p8q

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:apache:maven_shared_utils:*:*:*:*:*:*:*:*before 3.3.3VulnerableApache
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*11.0VulnerableDebian
  • cpe:2.3:a:apache:maven_shared_utils:*:*:*:*:*:*:*:* Versions before 3.3.3 Vulnerable ·Apache
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian

Remediation

  • Fix · CNA Apache Maven (Apache Software Foundation) Fixed in 3.3.3
  • Fix · GHSA-rhgr-952r-6p8q org.apache.maven.shared:maven-shared-utils (Maven) Fixed in 3.3.3 Advisory →

Red Hat 18 advisories

  • RHSA-2024:0775 Released 2024-02-12 · Red Hat rating Important
    jenkins and jenkins-2-plugins security update
    • OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8 jenkins-2-plugins-4.11.1706516946-1.el8, jenkins-2.426.3.1706516929-3.el8
  • RHSA-2024:0778 Released 2024-02-12 · Red Hat rating Important
    Jenkins and Jenkins-2-plugins security update
    • OpenShift Developer Tools and Services for OCP 4.12 jenkins-2-plugins-4.12.1706515741-1.el8, jenkins-2.426.3.1706515686-3.el8
  • RHSA-2024:0777 Released 2024-02-12 · Red Hat rating Important
    jenkins and jenkins-2-plugins security update
    • OpenShift Developer Tools and Services for OCP 4.14 jenkins-2-plugins-4.14.1706516441-1.el8, jenkins-2.426.3.1706516352-3.el8
Show 15 more Red Hat advisories
  • RHSA-2024:0776 Released 2024-02-12 · Red Hat rating Important
    jenkins and jenkins-2-plugins security update
    • OpenShift Developer Tools and Services for OCP 4.13 jenkins-2-plugins-4.13.1706516346-1.el8, jenkins-2.426.3.1706516254-3.el8
  • RHSA-2023:7288 Released 2023-11-16 · Red Hat rating Important
    Red Hat Product OCP Tools 4.14 Openshift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.14 jenkins-2-plugins-4.14.1699356715-1.el8, jenkins-2.414.3.1699356615-3.el8
  • RHSA-2023:6179 Released 2023-10-30 · Red Hat rating Critical
    Red Hat Product OCP Tools 4.13 OpenShift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.13 jenkins-2-plugins-4.13.1698292274-1.el8, jenkins-2.414.3.1698292201-3.el8
  • RHSA-2023:6172 Released 2023-10-30 · Red Hat rating Critical
    Red Hat Product OCP Tools 4.12 Openshift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.12 jenkins-2-plugins-4.12.1698294000-1.el8, jenkins-2.414.3.1698293911-3.el8
  • RHSA-2023:6171 Released 2023-10-30 · Red Hat rating Critical
    Red Hat Product OCP Tools 4.11 Openshift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8 jenkins-2-plugins-4.11.1698299029-1.el8, jenkins-2.414.3.1698298955-3.el8
  • RHSA-2023:3622 Released 2023-06-15 · Red Hat rating Important
    jenkins and jenkins-2-plugins security update
    • OpenShift Developer Tools and Services for OCP 4.13 jenkins-2-plugins-4.13.1686680473-1.el8, jenkins-2.401.1.1686680404-3.el8
  • RHSA-2023:3610 Released 2023-06-15 · Red Hat rating Important
    jenkins and jenkins-2-plugins security update
    • OpenShift Developer Tools and Services for OCP 4.12 jenkins-2-plugins-4.12.1686649756-1.el8, jenkins-2.401.1.1686649641-3.el8
  • RHSA-2023:3198 Released 2023-05-17 · Red Hat rating Critical
    jenkins and jenkins-2-plugins security update
    • OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8 jenkins-2-plugins-4.11.1683009941-1.el8, jenkins-2.387.1.1683009763-3.el8
  • RHSA-2023:0573 Released 2023-02-09 · Red Hat rating Important
    OpenShift Container Platform 4.9.55 security update
    • Red Hat OpenShift Container Platform 4.9 jenkins-2-plugins-4.9.1674644684-1.el8
  • RHSA-2022:9098 Released 2023-01-04 · Red Hat rating Important
    OpenShift Container Platform 4.10.46 packages and security update
    • Red Hat OpenShift Container Platform 4.10 jenkins-2-plugins-4.10.1670851835-1.el8
  • RHSA-2022:4798 Released 2022-05-30 · Red Hat rating Important
    maven:3.5 security update
    • Red Hat Enterprise Linux AppStream (v. 8) aopalliance-1.0-17.module+el8+2452+b359bfcd.noarch::maven:3.5, aopalliance-1.0-17.module+el8+2452+b359bfcd.src::maven:3.5, apache-commons-cli-1.4-4.module+el8+2452+b359bfcd.noarch::maven:3.5 +47
    • Red Hat Enterprise Linux AppStream EUS (v. 8.2) aopalliance-1.0-17.module+el8+2452+b359bfcd.noarch::maven:3.5, aopalliance-1.0-17.module+el8+2452+b359bfcd.src::maven:3.5, apache-commons-cli-1.4-4.module+el8+2452+b359bfcd.noarch::maven:3.5 +47
    • Red Hat Enterprise Linux AppStream EUS (v.8.4) aopalliance-1.0-17.module+el8+2452+b359bfcd.noarch::maven:3.5, aopalliance-1.0-17.module+el8+2452+b359bfcd.src::maven:3.5, apache-commons-cli-1.4-4.module+el8+2452+b359bfcd.noarch::maven:3.5 +47
  • RHSA-2022:4797 Released 2022-05-30 · Red Hat rating Important
    maven:3.6 security update
    • Red Hat Enterprise Linux AppStream (v. 8) aopalliance-1.0-20.module+el8.6.0+13337+afcb49ec.noarch::maven:3.6, aopalliance-1.0-20.module+el8.6.0+13337+afcb49ec.src::maven:3.6, apache-commons-cli-1.4-7.module+el8.6.0+13337+afcb49ec.noarch::maven:3.6 +47
    • Red Hat Enterprise Linux AppStream EUS (v. 8.2) aopalliance-1.0-20.module+el8.2.0+5557+11a14461.noarch::maven:3.6, aopalliance-1.0-20.module+el8.2.0+5557+11a14461.src::maven:3.6, apache-commons-cli-1.4-7.module+el8.2.0+5557+11a14461.noarch::maven:3.6 +47
    • Red Hat Enterprise Linux AppStream EUS (v.8.4) aopalliance-1.0-20.module+el8.3.0+6804+157bd82e.noarch::maven:3.6, aopalliance-1.0-20.module+el8.3.0+6804+157bd82e.src::maven:3.6, apache-commons-cli-1.4-7.module+el8.3.0+6804+157bd82e.noarch::maven:3.6 +47
  • RHSA-2022:4699 Released 2022-05-23 · Red Hat rating Important
    maven:3.5 security update
    • Red Hat Enterprise Linux AppStream E4S (v. 8.1) aopalliance-1.0-17.module+el8+2452+b359bfcd.noarch::maven:3.5, aopalliance-1.0-17.module+el8+2452+b359bfcd.src::maven:3.5, apache-commons-cli-1.4-4.module+el8+2452+b359bfcd.noarch::maven:3.5 +47
  • RHSA-2022:1662 Released 2022-05-02 · Red Hat rating Important
    rh-maven36-maven-shared-utils security update
    • Red Hat Software Collections for RHEL Workstation(v. 7) rh-maven36-maven-shared-utils-3.2.1-0.2.3.el7, rh-maven36-maven-shared-utils-javadoc-3.2.1-0.2.3.el7
    • Red Hat Software Collections for RHEL(v. 7) rh-maven36-maven-shared-utils-3.2.1-0.2.3.el7, rh-maven36-maven-shared-utils-javadoc-3.2.1-0.2.3.el7
  • RHSA-2022:1541 Released 2022-04-26 · Red Hat rating Important
    maven-shared-utils security update
    • Red Hat Enterprise Linux Client Optional (v. 7) maven-shared-utils-0.4-4.el7_9, maven-shared-utils-javadoc-0.4-4.el7_9
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) maven-shared-utils-0.4-4.el7_9, maven-shared-utils-javadoc-0.4-4.el7_9
    • Red Hat Enterprise Linux Server Optional (v. 7) maven-shared-utils-0.4-4.el7_9, maven-shared-utils-javadoc-0.4-4.el7_9
    • Red Hat Enterprise Linux Workstation Optional (v. 7) maven-shared-utils-0.4-4.el7_9, maven-shared-utils-javadoc-0.4-4.el7_9

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Integration Data Virtualisation OperatorAffectedNo fix planned: Out of support scope
Red Hat Integration Service RegistryAffectedNo fix planned: Out of support scope
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Web Server 3AffectedNo fix planned: Out of support scope
OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8Fixed RHSA-2023:3198, RHSA-2023:6171, RHSA-2024:0775
OpenShift Developer Tools and Services for OCP 4.12Fixed RHSA-2023:3610, RHSA-2023:6172, RHSA-2024:0778
OpenShift Developer Tools and Services for OCP 4.13Fixed RHSA-2023:3622, RHSA-2023:6179, RHSA-2024:0776
OpenShift Developer Tools and Services for OCP 4.14Fixed RHSA-2023:7288, RHSA-2024:0777
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2022:4797, RHSA-2022:4798
Red Hat Enterprise Linux AppStream E4S (v. 8.1)Fixed RHSA-2022:4699
Red Hat Enterprise Linux AppStream EUS (v. 8.2)Fixed RHSA-2022:4797, RHSA-2022:4798
Red Hat Enterprise Linux AppStream EUS (v.8.4)Fixed RHSA-2022:4797, RHSA-2022:4798
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2022:1541
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2022:1541
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2022:1541
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2022:1541
Red Hat OpenShift Container Platform 4.10Fixed RHSA-2022:9098
Red Hat OpenShift Container Platform 4.9Fixed RHSA-2023:0573
Red Hat Software Collections for RHEL Workstation(v. 7)Fixed RHSA-2022:1662
Red Hat Software Collections for RHEL(v. 7)Fixed RHSA-2022:1662
Not affected: 26 products
  • A-MQ Clients 2
  • Logging Subsystem for Red Hat OpenShift
  • OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8
  • OpenShift Developer Tools and Services for OCP 4.12
  • OpenShift Developer Tools and Services for OCP 4.13
  • OpenShift Developer Tools and Services for OCP 4.14
  • Red Hat A-MQ Online
  • Red Hat AMQ Broker 7
  • Red Hat Data Grid 8
  • Red Hat Decision Manager 7
  • Red Hat Enterprise Linux 9
  • Red Hat Fuse 7
  • Red Hat Integration Camel K 1
  • Red Hat Integration Camel Quarkus 1
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat JBoss Web Server 5
  • Red Hat OpenShift Application Runtimes
  • Red Hat OpenShift Container Platform 4.10
  • Red Hat Process Automation 7
  • Red Hat Single Sign-On 7
  • Red Hat build of Apicurio Registry 2
  • Red Hat build of Debezium 1
  • Red Hat build of Quarkus
  • Red Hat support for Spring Boot
  • streams for Apache Kafka

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-29599
  2. 2026-10-03 Alias added: GHSA-rhgr-952r-6p8q

References

Patch 2

Advisory 4

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences