https://bugzilla.redhat.com/show_bug.cgi?id=2066479
Bug ID: 2066479 Summary: maven-shared-utils: Command injection via Commandline class Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team@redhat.com Reporter: psampaio@redhat.com CC: aileenc@redhat.com, asoldano@redhat.com, bbaranow@redhat.com, bmaxwell@redhat.com, brian.stansberry@redhat.com, cdewolf@redhat.com, chazlett@redhat.com, darran.lofthouse@redhat.com, dkreling@redhat.com, dosoudil@redhat.com, drieden@redhat.com, fjansen@redhat.com, fjuma@redhat.com, ggastald@redhat.com, ggaughan@redhat.com, gmalinko@redhat.com, hhorak@redhat.com, iweiss@redhat.com, janstey@redhat.com, java-sig-commits@lists.fedoraproject.org, jochrist@redhat.com, jorton@redhat.com, jwon@redhat.com, kaycoth@redhat.com, krathod@redhat.com, lgao@redhat.com, mizdebsk@redhat.com, mosmerov@redhat.com, msochure@redhat.com, msvehla@redhat.com, nwallace@redhat.com, pjindal@redhat.com, pmackay@redhat.com, rstancel@redhat.com, rsvoboda@redhat.com, sbiarozk@redhat.com, smaestri@redhat.com, tom.jenkinson@redhat.com Target Milestone: --- Classification: Other
org.apache.maven.shared:maven-shared-utils is a functional replacement for plexus-utils in Maven. Affected versions of this package are vulnerable to Command Injection. The Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks. The BourneShell class should unconditionally single-quote emitted strings (including the name of the command itself being quoted), with {{'"'"'}} used for embedded single quotes, for maximum safety across shells implementing a superset of POSIX quoting rules.
References:
https://security.snyk.io/vuln/SNYK-JAVA-ORGAPACHEMAVENSHARED-570592 https://issues.apache.org/jira/browse/MSHARED-297 https://github.com/apache/maven-shared-utils/pull/40
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
Pedro Sampaio psampaio@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2066480
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=2066480 [Bug 2066480] maven-shared-utils: Command injection via Commandline class [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
--- Comment #1 from Pedro Sampaio psampaio@redhat.com --- Created maven-shared-utils tracking bugs for this issue:
Affects: fedora-all [bug 2066480]
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
Pedro Sampaio psampaio@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |2061553
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
Pedro Sampaio psampaio@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks|2061553 |
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
Pedro Sampaio psampaio@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |2066481
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
juneau@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2068193
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
Mauro Matteo Cascella mcascell@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Fixed In Version| |maven-shared-utils 3.3.3
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
Mauro Matteo Cascella mcascell@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2068643, 2068650, 2068631, | |2068651, 2068637, 2068641, | |2068644, 2068649, 2068639, | |2068633, 2068635, 2068647, | |2068640, 2068645, 2068642, | |2068630, 2068632, 2068646, | |2068638, 2068648, 2068634, | |2068636
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
--- Comment #4 from Mauro Matteo Cascella mcascell@redhat.com --- Upstream commit: https://github.com/apache/maven-shared-utils/commit/f751e614c09df8de1a080dc1...
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
Mauro Matteo Cascella mcascell@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2069081
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
Vipul Nair vinair@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2070059, 2070057, 2070058
https://bugzilla.redhat.com/show_bug.cgi?id=2066479 Bug 2066479 depends on bug 2066480, which changed state.
Bug 2066480 Summary: maven-shared-utils: Command injection via Commandline class [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2066480
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |NOTABUG
https://bugzilla.redhat.com/show_bug.cgi?id=2066479 Bug 2066479 depends on bug 2066480, which changed state.
Bug 2066480 Summary: maven-shared-utils: Command injection via Commandline class [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2066480
What |Removed |Added ---------------------------------------------------------------------------- Status|CLOSED |NEW Resolution|NOTABUG |---
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
Pedro Sampaio psampaio@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Summary|maven-shared-utils: Command |CVE-2022-29599 |injection via Commandline |maven-shared-utils: Command |class |injection via Commandline | |class Alias| |CVE-2022-29599
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
--- Comment #9 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Enterprise Linux 7
Via RHSA-2022:1541 https://access.redhat.com/errata/RHSA-2022:1541
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:1541
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
--- Comment #10 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Software Collections for Red Hat Enterprise Linux 7
Via RHSA-2022:1662 https://access.redhat.com/errata/RHSA-2022:1662
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:1662
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
--- Comment #11 from Product Security DevOps Team prodsec-dev@redhat.com --- This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):
https://access.redhat.com/security/cve/cve-2022-29599
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
Product Security DevOps Team prodsec-dev@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |ERRATA Last Closed| |2022-05-02 12:45:32
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHBA-2022:1674
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHBA-2022:1707
https://bugzilla.redhat.com/show_bug.cgi?id=2066479 Bug 2066479 depends on bug 2066480, which changed state.
Bug 2066480 Summary: CVE-2022-29599 maven-shared-utils: Command injection via Commandline class [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2066480
What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |ERRATA
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
--- Comment #12 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions
Via RHSA-2022:4699 https://access.redhat.com/errata/RHSA-2022:4699
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:4699
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHBA-2022:4780
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
--- Comment #13 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Enterprise Linux 8.4 Extended Update Support Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 8.2 Extended Update Support
Via RHSA-2022:4797 https://access.redhat.com/errata/RHSA-2022:4797
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:4797
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
--- Comment #14 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Enterprise Linux 8.2 Extended Update Support Red Hat Enterprise Linux 8.4 Extended Update Support Red Hat Enterprise Linux 8
Via RHSA-2022:4798 https://access.redhat.com/errata/RHSA-2022:4798
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:4798
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHBA-2022:4837
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHBA-2022:4838
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
--- Doc Text *updated* by Patrick Del Bello pdelbell@redhat.com --- A flaw was found in maven-shared-utils package which allows a Command Injection due improper escaping, allowing a shell injection attack.
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
--- Doc Text *updated* by RaTasha Tillery-Smith rtillery@redhat.com --- A flaw was found in the maven-shared-utils package. This issue allows a Command Injection due to improper escaping, allowing a shell injection attack.
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHBA-2022:4878
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHBA-2022:4923
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHBA-2022:4995
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHBA-2022:4996
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHBA-2022:5007
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
--- Comment #17 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat OpenShift Container Platform 4.10
Via RHSA-2022:9098 https://access.redhat.com/errata/RHSA-2022:9098
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:9098
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
--- Comment #18 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat OpenShift Container Platform 4.9
Via RHSA-2023:0573 https://access.redhat.com/errata/RHSA-2023:0573
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2023:0573
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHBA-2023:0717
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
--- Comment #22 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
OpenShift Developer Tools and Services for OCP 4.11
Via RHSA-2023:3198 https://access.redhat.com/errata/RHSA-2023:3198
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2023:3198
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
--- Comment #24 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
OpenShift Developer Tools and Services for OCP 4.12
Via RHSA-2023:3610 https://access.redhat.com/errata/RHSA-2023:3610
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2023:3610
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
--- Comment #25 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
OpenShift Developer Tools and Services for OCP 4.13
Via RHSA-2023:3622 https://access.redhat.com/errata/RHSA-2023:3622
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2023:3622
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
--- Comment #26 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
OpenShift Developer Tools and Services for OCP 4.13
Via RHSA-2023:6179 https://access.redhat.com/errata/RHSA-2023:6179
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2023:6179
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
--- Comment #27 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
OpenShift Developer Tools and Services for OCP 4.14
Via RHSA-2023:7288 https://access.redhat.com/errata/RHSA-2023:7288
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2023:7288
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
--- Comment #28 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
OpenShift Developer Tools and Services for OCP 4.13
Via RHSA-2024:0776 https://access.redhat.com/errata/RHSA-2024:0776
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2024:0776
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
--- Comment #29 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
OpenShift Developer Tools and Services for OCP 4.14
Via RHSA-2024:0777 https://access.redhat.com/errata/RHSA-2024:0777
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2024:0777
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
--- Comment #30 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
OpenShift Developer Tools and Services for OCP 4.12
Via RHSA-2024:0778 https://access.redhat.com/errata/RHSA-2024:0778
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2024:0778
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
--- Comment #31 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
OpenShift Developer Tools and Services for OCP 4.11
Via RHSA-2024:0775 https://access.redhat.com/errata/RHSA-2024:0775
https://bugzilla.redhat.com/show_bug.cgi?id=2066479
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2024:0775
java-sig-commits@lists.fedoraproject.org