CRITICAL9.8

GHSA-8vhq-qq4p-grq3

OS Command Injection in Plexus-utils

Quick fix

GHSA-8vhq-qq4p-grq3 — org.codehaus.plexus:plexus-utils: upgrade to the fixed version with the command below.

# pom.xml: bump <version>3.0.16</version> for org.codehaus.plexus:plexus-utils

Details

Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.

Are you affected?

Enter the version of the package you're using.

Affected packages

Maven/org.codehaus.plexus:plexus-utils

Introduced in: 0Fixed in: 3.0.16

Fix# pom.xml: bump <version>3.0.16</version> for org.codehaus.plexus:plexus-utils

References

https://nvd.nist.gov/vuln/detail/CVE-2017-1000487[ADVISORY]
https://github.com/codehaus-plexus/plexus-utils/commit/b38a1b3a4352303e4312b2bb601a0d7ec6e28f41[WEB]
https://www.debian.org/security/2018/dsa-4149[WEB]
https://www.debian.org/security/2018/dsa-4146[WEB]
https://snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSPLEXUS-31522[WEB]
https://lists.debian.org/debian-lts-announce/2018/01/msg00011.html[WEB]
https://lists.debian.org/debian-lts-announce/2018/01/msg00010.html[WEB]
https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E[WEB]
https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E[WEB]
https://lists.apache.org/thread.html/r9584c4304c888f651d214341a939bd264ed30c9e3d0d30fe85097ecf@%3Ccommits.pulsar.apache.org%3E[WEB]
https://lists.apache.org/thread.html/r9584c4304c888f651d214341a939bd264ed30c9e3d0d30fe85097ecf%40%3Ccommits.pulsar.apache.org%3E[WEB]
https://lists.apache.org/thread.html/r2e94f72f53df432302d359fd66cfa9e9efb8d42633d54579a4377e62@%3Cdev.avro.apache.org%3E[WEB]
https://lists.apache.org/thread.html/r2e94f72f53df432302d359fd66cfa9e9efb8d42633d54579a4377e62%40%3Cdev.avro.apache.org%3E[WEB]
https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe@%3Ccommits.druid.apache.org%3E[WEB]
https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E[WEB]
https://github.com/codehaus-plexus/plexus-utils[PACKAGE]
https://access.redhat.com/errata/RHSA-2018:1322[WEB]