Description

In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks.

Remediation

References

http://www.openwall.com/lists/oss-security/2022/05/23/3

https://github.com/apache/maven-shared-utils/pull/40

https://issues.apache.org/jira/browse/MSHARED-297

https://lists.debian.org/debian-lts-announce/2022/08/msg00018.html

https://www.debian.org/security/2022/dsa-5242

Related Vulnerabilities

CVE-2022-38900 Vulnerability in maven package org.webjars.bowergithub.samverschueren:decode-uri-component

CVE-2022-31147 Vulnerability in maven package org.webjars.bowergithub.jquery-validation:jquery-validation

CVE-2020-13934 Vulnerability in maven package org.apache.tomcat:tomcat-coyote

CVE-2020-11991 Vulnerability in maven package org.apache.cocoon:cocoon-core

CVE-2010-2076 Vulnerability in maven package org.apache.cxf:cxf-common-utilities

Severity

Critical

Classification

CWE-116 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Mailing List Third Party Advisory Patch Vendor Advisory