Vulmon
Amazon Linux 2022 Security Advisory: ALAS-2022-060
Advisory Release Date: 2022-05-04 21:05 Pacific
Advisory Updated Date: 2022-05-06 16:19 Pacific
Severity:
Critical
References:
CVE-2022-29599
Issue Overview:
org.apache.maven.shared:maven-shared-utils is a functional replacement for plexus-utils in Maven. Affected versions of this package are vulnerable to Command Injection. The Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks. The BourneShell class should unconditionally single-quote emitted strings (including the name of the command itself being quoted), with {{'"'"'}} used for embedded single quotes, for maximum safety across shells implementing a superset of POSIX quoting rules. (CVE-2022-29599)
Affected Packages:
maven-shared-utils
Issue Correction:
Run dnf update --releasever=2022.0.20220504 maven-shared-utils to update your system.
New Packages:
noarch:
maven-shared-utils-3.2.1-0.8.amzn2022.0.1.noarch
maven-shared-utils-javadoc-3.2.1-0.8.amzn2022.0.1.noarch
src:
maven-shared-utils-3.2.1-0.8.amzn2022.0.1.src