Command injection in Apache Maven maven-shared-utils

CRITICO 9.8CVE-2022-29599 · GHSA-rhgr-952r-6p8q · Published 23/05/2022 · updated 17/06/2026

In breve

CVE-2022-29599 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda org.apache.maven.shared:maven-shared-utils, maven shared utils (apache).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 4.4%, superiore al 91.4% delle vulnerabilità.
Correzione: aggiornare a 3.3.3 o successiva.

Package	Affected versions	Patched versions
org.apache.maven.shared:maven-shared-utils Maven	`< 3.3.3`	`3.3.3`
maven shared utils apache	`< 3.3.3`	`3.3.3`

Description

In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks.

NVD description

In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks.

References

nvd.nist.gov/vuln/detail/CVE-2022-29599 · ADVISORY
apache/maven-shared-utils#40 · WEB
apache/maven-shared-utils · PACKAGE
issues.apache.org/jira/browse/MSHARED-297 · WEB
lists.debian.org/debian-lts-announce/2022/08/msg00018.html · WEB
debian.org/security/2022/dsa-5242 · WEB
openwall.com/lists/oss-security/2022/05/23/3 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free