critical
CVE-2022-29599
maven-shared-utils: Command injection via Commandline class
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy's own label is CRITICAL. Rated critical by NVD, GHSA, Amazon. Rated lower by Red Hat (high), AlmaLinux (high), Oracle (high), Rocky Linux (high), Ubuntu (medium).
Description
In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| amazon linux 2 | maven-shared-utils, maven-shared-utils-javadoc | 0.4-4.amzn2 |
| amazon linux 2022 | maven-shared-utils, maven-shared-utils-javadoc | 3.3.4-4.amzn2022.0.2 |
| amazon linux 2023 | maven-shared-utils, maven-shared-utils-javadoc | 3.3.4-4.amzn2023.0.3 |
| maven::GitHub Security Advisory Maven | org.apache.maven.shared:maven-shared-utils | 3.3.3 |
| alma 8 | maven:3.5::aopalliance, maven:3.5::apache-commons-cli, maven:3.5::apache-commons-codec and 71 more | 1.0-17.module_el8.6.0+2752+f1f3449e and 58 more |
| debian 10 | maven-shared-utils | 3.3.0-1+deb10u1 |
| debian 11 | maven-shared-utils | 3.3.0-1+deb11u1 |
| debian 12 | maven-shared-utils | 3.3.4-1 |
| debian 13 | maven-shared-utils | 3.3.4-1 |
| debian 14 | maven-shared-utils | 3.3.4-1 |
| debian 9 | maven-shared-utils | 3.0.0-1+deb9u1 |
| echo | maven-shared-utils | 3.3.4-1 |
Show all 262 entries from 22 sources
| Source | Package | Fixed in |
|---|---|---|
| amazon linux 2 | maven-shared-utils | 0.4-4.amzn2 |
| amazon linux 2 | maven-shared-utils-javadoc | 0.4-4.amzn2 |
| amazon linux 2022 | maven-shared-utils | 3.3.4-4.amzn2022.0.2 |
| amazon linux 2022 | maven-shared-utils-javadoc | 3.3.4-4.amzn2022.0.2 |
| amazon linux 2023 | maven-shared-utils | 3.3.4-4.amzn2023.0.3 |
| amazon linux 2023 | maven-shared-utils-javadoc | 3.3.4-4.amzn2023.0.3 |
| maven::GitHub Security Advisory Maven | org.apache.maven.shared:maven-shared-utils | 3.3.3 |
| alma 8 | maven:3.5::aopalliance | 1.0-17.module_el8.6.0+2752+f1f3449e |
| alma 8 | maven:3.5::apache-commons-cli | 1.4-4.module_el8.6.0+2752+f1f3449e |
| alma 8 | maven:3.5::apache-commons-codec | 1.11-3.module_el8.6.0+2752+f1f3449e |
| alma 8 | maven:3.5::apache-commons-io | 1:2.6-3.module_el8.6.0+2752+f1f3449e |
| alma 8 | maven:3.5::apache-commons-lang3 | 3.7-3.module_el8.6.0+2752+f1f3449e |
| alma 8 | maven:3.5::apache-commons-logging | 1.2-13.module_el8.6.0+2752+f1f3449e |
| alma 8 | maven:3.5::atinject | 1-28.20100611svn86.module_el8.6.0+2752+f1f3449e |
| alma 8 | maven:3.5::cdi-api | 1.2-8.module_el8.6.0+2752+f1f3449e |
| alma 8 | maven:3.5::geronimo-annotation | 1.0-23.module_el8.6.0+2752+f1f3449e |
| alma 8 | maven:3.5::glassfish-el-api | 3.0.1-0.7.b08.module_el8.6.0+2752+f1f3449e |
| alma 8 | maven:3.5::google-guice | 4.1-11.module_el8.6.0+2752+f1f3449e |
| alma 8 | maven:3.5::guava20 | 20.0-8.module_el8.6.0+2752+f1f3449e |
| alma 8 | maven:3.5::hawtjni-runtime | 1.16-2.module_el8.6.0+2752+f1f3449e |
| alma 8 | maven:3.5::httpcomponents-client | 4.5.5-5.module_el8.6.0+2752+f1f3449e |
| alma 8 | maven:3.5::httpcomponents-core | 4.4.10-3.module_el8.6.0+2752+f1f3449e |
| alma 8 | maven:3.5::jansi | 1.17.1-1.module_el8.0.0+6044+f3cbc35d |
| alma 8 | maven:3.5::jansi-native | 1.7-7.module_el8.6.0+2752+f1f3449e |
| alma 8 | maven:3.5::jboss-interceptors-1.2-api | 1.0.0-8.module_el8.6.0+2752+f1f3449e |
| alma 8 | maven:3.5::jcl-over-slf4j | 1.7.25-4.module_el8.6.0+2752+f1f3449e |
| alma 8 | maven:3.5::jsoup | 1.11.3-3.module_el8.6.0+2752+f1f3449e |
| alma 8 | maven:3.5::maven | 1:3.5.4-5.module_el8.6.0+2752+f1f3449e |
| alma 8 | maven:3.5::maven-lib | 1:3.5.4-5.module_el8.6.0+2752+f1f3449e |
| alma 8 | maven:3.5::maven-resolver-api | 1:1.1.1-2.module_el8.6.0+2752+f1f3449e |
| alma 8 | maven:3.5::maven-resolver-connector-basic | 1:1.1.1-2.module_el8.6.0+2752+f1f3449e |
| alma 8 | maven:3.5::maven-resolver-impl | 1:1.1.1-2.module_el8.6.0+2752+f1f3449e |
| alma 8 | maven:3.5::maven-resolver-spi | 1:1.1.1-2.module_el8.6.0+2752+f1f3449e |
| alma 8 | maven:3.5::maven-resolver-transport-wagon | 1:1.1.1-2.module_el8.6.0+2752+f1f3449e |
| alma 8 | maven:3.5::maven-resolver-util | 1:1.1.1-2.module_el8.6.0+2752+f1f3449e |
| alma 8 | maven:3.5::maven-shared-utils | 3.2.1-0.2.module_el8.6.0+2902+097a4293 |
| alma 8 | maven:3.5::maven-wagon-file | 3.1.0-1.module_el8.6.0+2752+f1f3449e |
| alma 8 | maven:3.5::maven-wagon-http | 3.1.0-1.module_el8.6.0+2752+f1f3449e |
| alma 8 | maven:3.5::maven-wagon-http-shared | 3.1.0-1.module_el8.6.0+2752+f1f3449e |
| alma 8 | maven:3.5::maven-wagon-provider-api | 3.1.0-1.module_el8.6.0+2752+f1f3449e |
| alma 8 | maven:3.5::plexus-cipher | 1.7-14.module_el8.6.0+2752+f1f3449e |
| alma 8 | maven:3.5::plexus-classworlds | 2.5.2-9.module_el8.6.0+2752+f1f3449e |
| alma 8 | maven:3.5::plexus-containers-component-annotations | 1.7.1-8.module_el8.6.0+2752+f1f3449e |
| alma 8 | maven:3.5::plexus-interpolation | 1.22-9.module_el8.6.0+2752+f1f3449e |
| alma 8 | maven:3.5::plexus-sec-dispatcher | 1.4-26.module_el8.6.0+2752+f1f3449e |
| alma 8 | maven:3.5::plexus-utils | 3.1.0-3.module_el8.6.0+2752+f1f3449e |
| alma 8 | maven:3.5::sisu-inject | 1:0.3.3-6.module_el8.6.0+2752+f1f3449e |
| alma 8 | maven:3.5::sisu-plexus | 1:0.3.3-6.module_el8.6.0+2752+f1f3449e |
| alma 8 | maven:3.5::slf4j | 1.7.25-4.module_el8.5.0+2577+9e95fe00 |
| alma 8 | maven:3.6::aopalliance | 1.0-20.module_el8.6.0+2786+d7c38b21 |
| alma 8 | maven:3.6::apache-commons-cli | 1.4-7.module_el8.6.0+2786+d7c38b21 |
| alma 8 | maven:3.6::apache-commons-codec | 1.13-3.module_el8.6.0+2786+d7c38b21 |
| alma 8 | maven:3.6::apache-commons-io | 1:2.6-6.module_el8.6.0+2786+d7c38b21 |
| alma 8 | maven:3.6::apache-commons-lang3 | 3.9-4.module_el8.6.0+2786+d7c38b21 |
| alma 8 | maven:3.6::atinject | 1-31.20100611svn86.module_el8.6.0+2786+d7c38b21 |
| alma 8 | maven:3.6::cdi-api | 2.0.1-3.module_el8.6.0+2786+d7c38b21 |
| alma 8 | maven:3.6::geronimo-annotation | 1.0-26.module_el8.6.0+2786+d7c38b21 |
| alma 8 | maven:3.6::google-guice | 4.2.2-4.module_el8.6.0+2786+d7c38b21 |
| alma 8 | maven:3.6::guava | 28.1-3.module_el8.6.0+2786+d7c38b21 |
| alma 8 | maven:3.6::httpcomponents-client | 4.5.10-4.module_el8.6.0+2786+d7c38b21 |
| alma 8 | maven:3.6::httpcomponents-core | 4.4.12-3.module_el8.6.0+2786+d7c38b21 |
| alma 8 | maven:3.6::jansi | 1.18-4.module_el8.6.0+2786+d7c38b21 |
| alma 8 | maven:3.6::jcl-over-slf4j | 1.7.28-3.module_el8.6.0+2786+d7c38b21 |
| alma 8 | maven:3.6::jsoup | 1.12.1-3.module_el8.6.0+2786+d7c38b21 |
| alma 8 | maven:3.6::jsr-305 | 0-0.25.20130910svn.module_el8.6.0+2786+d7c38b21 |
| alma 8 | maven:3.6::maven | 1:3.6.2-7.module_el8.6.0+2786+d7c38b21 |
| alma 8 | maven:3.6::maven-lib | 1:3.6.2-7.module_el8.6.0+2786+d7c38b21 |
| alma 8 | maven:3.6::maven-openjdk11 | 1:3.6.2-7.module_el8.6.0+2786+d7c38b21 |
| alma 8 | maven:3.6::maven-openjdk17 | 1:3.6.2-7.module_el8.6.0+2786+d7c38b21 |
| alma 8 | maven:3.6::maven-openjdk8 | 1:3.6.2-7.module_el8.6.0+2786+d7c38b21 |
| alma 8 | maven:3.6::maven-resolver | 1.4.1-3.module_el8.6.0+2786+d7c38b21 |
| alma 8 | maven:3.6::maven-shared-utils | 3.2.1-0.5.module_el8.6.0+2903+d6ca2362 |
| alma 8 | maven:3.6::maven-wagon | 3.3.4-2.module_el8.6.0+2786+d7c38b21 |
| alma 8 | maven:3.6::plexus-cipher | 1.7-17.module_el8.6.0+2786+d7c38b21 |
| alma 8 | maven:3.6::plexus-classworlds | 2.6.0-4.module_el8.6.0+2786+d7c38b21 |
| alma 8 | maven:3.6::plexus-containers-component-annotations | 2.1.0-2.module_el8.6.0+2786+d7c38b21 |
| alma 8 | maven:3.6::plexus-interpolation | 1.26-3.module_el8.6.0+2786+d7c38b21 |
| alma 8 | maven:3.6::plexus-sec-dispatcher | 1.4-29.module_el8.6.0+2786+d7c38b21 |
| alma 8 | maven:3.6::plexus-utils | 3.3.0-3.module_el8.6.0+2786+d7c38b21 |
| alma 8 | maven:3.6::sisu | 0.3.4-2.module_el8.6.0+2786+d7c38b21 |
| alma 8 | maven:3.6::slf4j | 1.7.28-3.module_el8.6.0+2786+d7c38b21 |
| debian 10 | maven-shared-utils | 3.3.0-1+deb10u1 |
| debian 11 | maven-shared-utils | 3.3.0-1+deb11u1 |
| debian 12 | maven-shared-utils | 3.3.4-1 |
| debian 13 | maven-shared-utils | 3.3.4-1 |
| debian 14 | maven-shared-utils | 3.3.4-1 |
| debian 9 | maven-shared-utils | 3.0.0-1+deb9u1 |
| echo | maven-shared-utils | 3.3.4-1 |
| Oracle Linux 7 | maven-shared-utils | 0.4-4.el7_9 |
| Oracle Linux 7 | maven-shared-utils-javadoc | 0.4-4.el7_9 |
| Oracle Linux 8 | aopalliance | 1.0-20.module+el8.6.0+20615+edd0bff8 |
| Oracle Linux 8 | apache-commons-cli | 1.4-7.module+el8.6.0+20615+edd0bff8 |
| Oracle Linux 8 | apache-commons-codec | 1.13-3.module+el8.6.0+20615+edd0bff8 |
| Oracle Linux 8 | apache-commons-io | 1:2.6-6.module+el8.6.0+20615+edd0bff8 |
| Oracle Linux 8 | apache-commons-lang3 | 3.9-4.module+el8.6.0+20615+edd0bff8 |
| Oracle Linux 8 | apache-commons-logging | 1.2-13.module+el8+5161+5cac467c |
| Oracle Linux 8 | atinject | 1-31.20100611svn86.module+el8.6.0+20615+edd0bff8 |
| Oracle Linux 8 | cdi-api | 2.0.1-3.module+el8.6.0+20615+edd0bff8 |
| Oracle Linux 8 | geronimo-annotation | 1.0-26.module+el8.6.0+20615+edd0bff8 |
| Oracle Linux 8 | glassfish-el-api | 3.0.1-0.7.b08.module+el8+5161+5cac467c |
| Oracle Linux 8 | google-guice | 4.2.2-4.module+el8.6.0+20615+edd0bff8 |
| Oracle Linux 8 | guava | 28.1-3.module+el8.6.0+20615+edd0bff8 |
| Oracle Linux 8 | guava20 | 20.0-8.module+el8+5161+5cac467c |
| Oracle Linux 8 | hawtjni-runtime | 1.16-2.module+el8+5161+5cac467c |
| Oracle Linux 8 | httpcomponents-client | 4.5.10-4.module+el8.6.0+20615+edd0bff8 |
| Oracle Linux 8 | httpcomponents-core | 4.4.12-3.module+el8.6.0+20615+edd0bff8 |
| Oracle Linux 8 | jansi | 1.18-4.module+el8.6.0+20615+edd0bff8 |
| Oracle Linux 8 | jansi-native | 1.7-7.module+el8+5161+5cac467c |
| Oracle Linux 8 | jboss-interceptors-1.2-api | 1.0.0-8.module+el8+5161+5cac467c |
| Oracle Linux 8 | jcl-over-slf4j | 1.7.28-3.module+el8.6.0+20615+edd0bff8 |
| Oracle Linux 8 | jsoup | 1.12.1-3.module+el8.6.0+20615+edd0bff8 |
| Oracle Linux 8 | jsr-305 | 0-0.25.20130910svn.module+el8.6.0+20615+edd0bff8 |
| Oracle Linux 8 | maven | 1:3.6.2-7.module+el8.6.0+20615+edd0bff8 |
| Oracle Linux 8 | maven-lib | 1:3.6.2-7.module+el8.6.0+20615+edd0bff8 |
| Oracle Linux 8 | maven-openjdk11 | 1:3.6.2-7.module+el8.6.0+20615+edd0bff8 |
| Oracle Linux 8 | maven-openjdk17 | 1:3.6.2-7.module+el8.6.0+20615+edd0bff8 |
| Oracle Linux 8 | maven-openjdk8 | 1:3.6.2-7.module+el8.6.0+20615+edd0bff8 |
| Oracle Linux 8 | maven-resolver | 1.4.1-3.module+el8.6.0+20615+edd0bff8 |
| Oracle Linux 8 | maven-resolver-api | 1:1.1.1-2.module+el8+5161+5cac467c |
| Oracle Linux 8 | maven-resolver-connector-basic | 1:1.1.1-2.module+el8+5161+5cac467c |
| Oracle Linux 8 | maven-resolver-impl | 1:1.1.1-2.module+el8+5161+5cac467c |
| Oracle Linux 8 | maven-resolver-spi | 1:1.1.1-2.module+el8+5161+5cac467c |
| Oracle Linux 8 | maven-resolver-transport-wagon | 1:1.1.1-2.module+el8+5161+5cac467c |
| Oracle Linux 8 | maven-resolver-util | 1:1.1.1-2.module+el8+5161+5cac467c |
| Oracle Linux 8 | maven-shared-utils | 3.2.1-0.4.module+el8.6.0+20675+b1cf145f |
| Oracle Linux 8 | maven-wagon | 3.3.4-2.module+el8.6.0+20615+edd0bff8 |
| Oracle Linux 8 | maven-wagon-file | 3.1.0-1.module+el8+5161+5cac467c |
| Oracle Linux 8 | maven-wagon-http | 3.1.0-1.module+el8+5161+5cac467c |
| Oracle Linux 8 | maven-wagon-http-shared | 3.1.0-1.module+el8+5161+5cac467c |
| Oracle Linux 8 | maven-wagon-provider-api | 3.1.0-1.module+el8+5161+5cac467c |
| Oracle Linux 8 | plexus-cipher | 1.7-17.module+el8.6.0+20615+edd0bff8 |
| Oracle Linux 8 | plexus-classworlds | 2.6.0-4.module+el8.6.0+20615+edd0bff8 |
| Oracle Linux 8 | plexus-containers-component-annotations | 2.1.0-2.module+el8.6.0+20615+edd0bff8 |
| Oracle Linux 8 | plexus-interpolation | 1.26-3.module+el8.6.0+20615+edd0bff8 |
| Oracle Linux 8 | plexus-sec-dispatcher | 1.4-29.module+el8.6.0+20615+edd0bff8 |
| Oracle Linux 8 | plexus-utils | 3.3.0-3.module+el8.6.0+20615+edd0bff8 |
| Oracle Linux 8 | sisu | 0.3.4-2.module+el8.6.0+20615+edd0bff8 |
| Oracle Linux 8 | sisu-inject | 1:0.3.3-6.module+el8+5161+5cac467c |
| Oracle Linux 8 | sisu-plexus | 1:0.3.3-6.module+el8+5161+5cac467c |
| Oracle Linux 8 | slf4j | 1.7.28-3.module+el8.6.0+20615+edd0bff8 |
| Red Hat | maven-shared-utils | no fix listed |
| rocky 8 | aopalliance | 1.0-17.module+el8.6.0+843+5a13dac3 |
| rocky 8 | apache-commons-cli | 1.4-4.module+el8.6.0+843+5a13dac3 |
| rocky 8 | apache-commons-codec | 1.11-3.module+el8.6.0+843+5a13dac3 |
| rocky 8 | apache-commons-io | 1:2.6-3.module+el8.6.0+843+5a13dac3 |
| rocky 8 | apache-commons-lang3 | 3.7-3.module+el8.6.0+843+5a13dac3 |
| rocky 8 | atinject | 1-28.20100611svn86.module+el8.6.0+843+5a13dac3 |
| rocky 8 | cdi-api | 1.2-8.module+el8.6.0+843+5a13dac3 |
| rocky 8 | geronimo-annotation | 1.0-23.module+el8.6.0+843+5a13dac3 |
| rocky 8 | glassfish-el-api | 3.0.1-0.7.b08.module+el8.6.0+975+c0ed2db8 |
| rocky 8 | google-guice | 4.1-11.module+el8.6.0+843+5a13dac3 |
| rocky 8 | httpcomponents-client | 4.5.5-5.module+el8.6.0+843+5a13dac3 |
| rocky 8 | httpcomponents-core | 4.4.10-3.module+el8.6.0+843+5a13dac3 |
| rocky 8 | jansi | 1.17.1-1.module+el8.6.0+843+5a13dac3 |
| rocky 8 | jansi-native | 1.7-7.module+el8.3.0+133+b8b54b58 |
| rocky 8 | jsoup | 1.11.3-3.module+el8.6.0+843+5a13dac3 |
| rocky 8 | maven | 1:3.5.4-5.module+el8.6.0+975+c0ed2db8 |
| rocky 8 | maven-lib | 1:3.5.4-5.module+el8.6.0+975+c0ed2db8 |
| rocky 8 | maven-openjdk11 | 1:3.6.2-7.module+el8.6.0+976+839b99e9 |
| rocky 8 | maven-openjdk17 | 1:3.6.2-7.module+el8.6.0+976+839b99e9 |
| rocky 8 | maven-openjdk8 | 1:3.6.2-7.module+el8.6.0+976+839b99e9 |
| rocky 8 | maven-resolver-api | 1:1.1.1-2.module+el8.6.0+843+5a13dac3 |
| rocky 8 | maven-resolver-connector-basic | 1:1.1.1-2.module+el8.6.0+843+5a13dac3 |
| rocky 8 | maven-resolver-impl | 1:1.1.1-2.module+el8.6.0+843+5a13dac3 |
| rocky 8 | maven-resolver-spi | 1:1.1.1-2.module+el8.6.0+843+5a13dac3 |
| rocky 8 | maven-resolver-transport-wagon | 1:1.1.1-2.module+el8.6.0+843+5a13dac3 |
| rocky 8 | maven-resolver-util | 1:1.1.1-2.module+el8.6.0+843+5a13dac3 |
| rocky 8 | maven-shared-utils | 3.2.1-0.2.module+el8.6.0+975+c0ed2db8 |
| rocky 8 | maven-wagon-file | 3.1.0-1.module+el8.6.0+843+5a13dac3 |
| rocky 8 | maven-wagon-http | 3.1.0-1.module+el8.6.0+843+5a13dac3 |
| rocky 8 | maven-wagon-http-shared | 3.1.0-1.module+el8.6.0+843+5a13dac3 |
| rocky 8 | maven-wagon-provider-api | 3.1.0-1.module+el8.6.0+843+5a13dac3 |
| rocky 8 | maven:3.5::aopalliance | 1.0-17.module+el8.6.0+843+5a13dac3 |
| rocky 8 | maven:3.5::apache-commons-cli | 1.4-4.module+el8.6.0+843+5a13dac3 |
| rocky 8 | maven:3.5::apache-commons-codec | 1.11-3.module+el8.6.0+843+5a13dac3 |
| rocky 8 | maven:3.5::apache-commons-io | 1:2.6-3.module+el8.6.0+843+5a13dac3 |
| rocky 8 | maven:3.5::apache-commons-lang3 | 3.7-3.module+el8.6.0+843+5a13dac3 |
| rocky 8 | maven:3.5::apache-commons-logging | 1.2-13.module+el8.3.0+133+b8b54b58 |
| rocky 8 | maven:3.5::atinject | 1-28.20100611svn86.module+el8.6.0+843+5a13dac3 |
| rocky 8 | maven:3.5::cdi-api | 1.2-8.module+el8.6.0+843+5a13dac3 |
| rocky 8 | maven:3.5::geronimo-annotation | 1.0-23.module+el8.6.0+843+5a13dac3 |
| rocky 8 | maven:3.5::glassfish-el-api | 3.0.1-0.7.b08.module+el8.6.0+975+c0ed2db8 |
| rocky 8 | maven:3.5::google-guice | 4.1-11.module+el8.6.0+843+5a13dac3 |
| rocky 8 | maven:3.5::guava20 | 20.0-8.module+el8.3.0+133+b8b54b58 |
| rocky 8 | maven:3.5::hawtjni-runtime | 1.16-2.module+el8.3.0+133+b8b54b58 |
| rocky 8 | maven:3.5::httpcomponents-client | 4.5.5-5.module+el8.6.0+843+5a13dac3 |
| rocky 8 | maven:3.5::httpcomponents-core | 4.4.10-3.module+el8.6.0+843+5a13dac3 |
| rocky 8 | maven:3.5::jansi | 1.17.1-1.module+el8.3.0+133+b8b54b58 |
| rocky 8 | maven:3.5::jansi-native | 1.7-7.module+el8.3.0+133+b8b54b58 |
| rocky 8 | maven:3.5::jboss-interceptors-1.2-api | 1.0.0-8.module+el8.3.0+133+b8b54b58 |
| rocky 8 | maven:3.5::jcl-over-slf4j | 1.7.25-4.module+el8.6.0+843+5a13dac3 |
| rocky 8 | maven:3.5::jsoup | 1.11.3-3.module+el8.6.0+843+5a13dac3 |
| rocky 8 | maven:3.5::maven | 1:3.5.4-5.module+el8.6.0+975+c0ed2db8 |
| rocky 8 | maven:3.5::maven-lib | 1:3.5.4-5.module+el8.6.0+975+c0ed2db8 |
| rocky 8 | maven:3.5::maven-resolver-api | 1:1.1.1-2.module+el8.6.0+843+5a13dac3 |
| rocky 8 | maven:3.5::maven-resolver-connector-basic | 1:1.1.1-2.module+el8.6.0+843+5a13dac3 |
| rocky 8 | maven:3.5::maven-resolver-impl | 1:1.1.1-2.module+el8.6.0+843+5a13dac3 |
| rocky 8 | maven:3.5::maven-resolver-spi | 1:1.1.1-2.module+el8.6.0+843+5a13dac3 |
| rocky 8 | maven:3.5::maven-resolver-transport-wagon | 1:1.1.1-2.module+el8.6.0+843+5a13dac3 |
| rocky 8 | maven:3.5::maven-resolver-util | 1:1.1.1-2.module+el8.6.0+843+5a13dac3 |
| rocky 8 | maven:3.5::maven-shared-utils | 3.2.1-0.2.module+el8.6.0+975+c0ed2db8 |
| rocky 8 | maven:3.5::maven-wagon-file | 3.1.0-1.module+el8.6.0+843+5a13dac3 |
| rocky 8 | maven:3.5::maven-wagon-http | 3.1.0-1.module+el8.6.0+843+5a13dac3 |
| rocky 8 | maven:3.5::maven-wagon-http-shared | 3.1.0-1.module+el8.6.0+843+5a13dac3 |
| rocky 8 | maven:3.5::maven-wagon-provider-api | 3.1.0-1.module+el8.6.0+843+5a13dac3 |
| rocky 8 | maven:3.5::plexus-cipher | 1.7-14.module+el8.6.0+843+5a13dac3 |
| rocky 8 | maven:3.5::plexus-classworlds | 2.5.2-9.module+el8.6.0+843+5a13dac3 |
| rocky 8 | maven:3.5::plexus-containers-component-annotations | 1.7.1-8.module+el8.6.0+843+5a13dac3 |
| rocky 8 | maven:3.5::plexus-interpolation | 1.22-9.module+el8.6.0+843+5a13dac3 |
| rocky 8 | maven:3.5::plexus-sec-dispatcher | 1.4-26.module+el8.6.0+843+5a13dac3 |
| rocky 8 | maven:3.5::plexus-utils | 3.1.0-3.module+el8.6.0+843+5a13dac3 |
| rocky 8 | maven:3.5::sisu-inject | 1:0.3.3-6.module+el8.6.0+843+5a13dac3 |
| rocky 8 | maven:3.5::sisu-plexus | 1:0.3.3-6.module+el8.6.0+843+5a13dac3 |
| rocky 8 | maven:3.5::slf4j | 1.7.25-4.module+el8.3.0+133+b8b54b58 |
| rocky 8 | maven:3.6::aopalliance | 1.0-20.module+el8.6.0+844+4401f2ed |
| rocky 8 | maven:3.6::apache-commons-cli | 1.4-7.module+el8.6.0+844+4401f2ed |
| rocky 8 | maven:3.6::apache-commons-codec | 1.13-3.module+el8.6.0+844+4401f2ed |
| rocky 8 | maven:3.6::apache-commons-io | 1:2.6-6.module+el8.6.0+844+4401f2ed |
| rocky 8 | maven:3.6::apache-commons-lang3 | 3.9-4.module+el8.6.0+844+4401f2ed |
| rocky 8 | maven:3.6::atinject | 1-31.20100611svn86.module+el8.6.0+844+4401f2ed |
| rocky 8 | maven:3.6::cdi-api | 2.0.1-3.module+el8.6.0+844+4401f2ed |
| rocky 8 | maven:3.6::geronimo-annotation | 1.0-26.module+el8.6.0+844+4401f2ed |
| rocky 8 | maven:3.6::google-guice | 4.2.2-4.module+el8.6.0+844+4401f2ed |
| rocky 8 | maven:3.6::guava | 28.1-3.module+el8.6.0+844+4401f2ed |
| rocky 8 | maven:3.6::httpcomponents-client | 4.5.10-4.module+el8.6.0+844+4401f2ed |
| rocky 8 | maven:3.6::httpcomponents-core | 4.4.12-3.module+el8.6.0+844+4401f2ed |
| rocky 8 | maven:3.6::jansi | 1.18-4.module+el8.6.0+844+4401f2ed |
| rocky 8 | maven:3.6::jcl-over-slf4j | 1.7.28-3.module+el8.6.0+844+4401f2ed |
| rocky 8 | maven:3.6::jsoup | 1.12.1-3.module+el8.6.0+844+4401f2ed |
| rocky 8 | maven:3.6::jsr-305 | 0-0.25.20130910svn.module+el8.6.0+844+4401f2ed |
| rocky 8 | maven:3.6::maven | 1:3.6.2-7.module+el8.6.0+976+839b99e9 |
| rocky 8 | maven:3.6::maven-lib | 1:3.6.2-7.module+el8.6.0+976+839b99e9 |
| rocky 8 | maven:3.6::maven-openjdk11 | 1:3.6.2-7.module+el8.6.0+976+839b99e9 |
| rocky 8 | maven:3.6::maven-openjdk17 | 1:3.6.2-7.module+el8.6.0+976+839b99e9 |
| rocky 8 | maven:3.6::maven-openjdk8 | 1:3.6.2-7.module+el8.6.0+976+839b99e9 |
| rocky 8 | maven:3.6::maven-resolver | 1.4.1-3.module+el8.6.0+844+4401f2ed |
| rocky 8 | maven:3.6::maven-shared-utils | 3.2.1-0.5.module+el8.6.0+976+839b99e9 |
| rocky 8 | maven:3.6::maven-wagon | 3.3.4-2.module+el8.6.0+844+4401f2ed |
| rocky 8 | maven:3.6::plexus-cipher | 1.7-17.module+el8.6.0+844+4401f2ed |
| rocky 8 | maven:3.6::plexus-classworlds | 2.6.0-4.module+el8.6.0+844+4401f2ed |
| rocky 8 | maven:3.6::plexus-containers-component-annotations | 2.1.0-2.module+el8.6.0+844+4401f2ed |
| rocky 8 | maven:3.6::plexus-interpolation | 1.26-3.module+el8.6.0+844+4401f2ed |
| rocky 8 | maven:3.6::plexus-sec-dispatcher | 1.4-29.module+el8.6.0+844+4401f2ed |
| rocky 8 | maven:3.6::plexus-utils | 3.3.0-3.module+el8.6.0+844+4401f2ed |
| rocky 8 | maven:3.6::sisu | 0.3.4-2.module+el8.6.0+844+4401f2ed |
| rocky 8 | maven:3.6::slf4j | 1.7.28-3.module+el8.6.0+844+4401f2ed |
| rocky 8 | pki-deps:10.6::slf4j | 1.7.25-4.module+el8.5.0+697+f586bb30 |
| rocky 8 | plexus-cipher | 1.7-14.module+el8.6.0+843+5a13dac3 |
| rocky 8 | plexus-classworlds | 2.5.2-9.module+el8.6.0+843+5a13dac3 |
| rocky 8 | plexus-containers-component-annotations | 1.7.1-8.module+el8.6.0+843+5a13dac3 |
| rocky 8 | plexus-interpolation | 1.22-9.module+el8.6.0+843+5a13dac3 |
| rocky 8 | plexus-sec-dispatcher | 1.4-26.module+el8.6.0+843+5a13dac3 |
| rocky 8 | plexus-utils | 3.1.0-3.module+el8.6.0+843+5a13dac3 |
| rocky 8 | scala:2.10::jansi | 1.17.1-1.module+el8.3.0+241+f23502a8 |
| rocky 8 | sisu-inject | 1:0.3.3-6.module+el8.6.0+843+5a13dac3 |
| rocky 8 | sisu-plexus | 1:0.3.3-6.module+el8.6.0+843+5a13dac3 |
| ubuntu 14.04-ESM | maven-shared-utils | 0.4-1ubuntu0.1~esm1 |
| ubuntu 16.04-ESM | maven-shared-utils | 0.9-1ubuntu0.1~esm1 |
| ubuntu 18.04-ESM | maven-shared-utils | 3.3.0-1ubuntu0.18.04.1~esm1 |
| ubuntu 20.04 | maven-shared-utils | 3.3.0-1ubuntu0.20.04.1 |
| ubuntu 20.04-ESM | maven-shared-utils | 3.3.0-1ubuntu0.20.04.1 |
| ubuntu 22.04 | maven-shared-utils | 3.3.0-1ubuntu0.22.04.1 |
References
- http://www.openwall.com/lists/oss-security/2022/05/23/3
- https://access.redhat.com/security/cve/CVE-2022-29599
- https://bugzilla.redhat.com/show_bug.cgi?id=2066479
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29599
- https://errata.almalinux.org/8/ALSA-2022-4798.html
- https://errata.rockylinux.org/RLSA-2022:4798
- https://github.com/apache/maven-shared-utils
- https://github.com/apache/maven-shared-utils/commit/f751e614c09df8de1a080dc1153931f3f68991c9
All 18 references
- https://github.com/apache/maven-shared-utils/pull/40
- https://issues.apache.org/jira/browse/MSHARED-297
- https://linux.oracle.com/cve/CVE-2022-29599.html
- https://linux.oracle.com/errata/ELSA-2022-4798.html
- https://lists.debian.org/debian-lts-announce/2022/08/msg00018.html
- https://nvd.nist.gov/vuln/detail/CVE-2022-29599
- https://rhn.redhat.com/errata/RHSA-2022-1662.html
- https://ubuntu.com/security/notices/USN-6730-1
- https://www.cve.org/CVERecord?id=CVE-2022-29599
- https://www.debian.org/security/2022/dsa-5242