https://bugzilla.redhat.com/show_bug.cgi?id=1532497
Bug ID: 1532497
Summary: CVE-2017-1000487 plexus-utils: Mishandled strings in
Commandline class allow for command injection
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: sfowler(a)redhat.com
CC: aileenc(a)redhat.com, alazarot(a)redhat.com,
anstephe(a)redhat.com, apevec(a)redhat.com,
bcourt(a)redhat.com, bdawidow(a)redhat.com,
bkearney(a)redhat.com, chazlett(a)redhat.com,
chrisw(a)redhat.com, drieden(a)redhat.com,
etirelli(a)redhat.com, fnasser(a)redhat.com,
gvarsami(a)redhat.com, hchiorea(a)redhat.com,
hghasemb(a)redhat.com, hhorak(a)redhat.com,
ibek(a)redhat.com, java-maint(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jcoleman(a)redhat.com, jjoyce(a)redhat.com,
jmatthew(a)redhat.com, jolee(a)redhat.com,
jorton(a)redhat.com, jschluet(a)redhat.com,
jstastny(a)redhat.com, kbasil(a)redhat.com,
kconner(a)redhat.com, kverlaen(a)redhat.com,
ldimaggi(a)redhat.com, lhh(a)redhat.com, lpeer(a)redhat.com,
lpetrovi(a)redhat.com, markmc(a)redhat.com,
mburns(a)redhat.com, mizdebsk(a)redhat.com,
mmccune(a)redhat.com, mrike(a)redhat.com,
msimacek(a)redhat.com, nwallace(a)redhat.com,
ohadlevy(a)redhat.com, paradhya(a)redhat.com,
pavelp(a)redhat.com, pdrozd(a)redhat.com,
pszubiak(a)redhat.com, rbryant(a)redhat.com,
rchan(a)redhat.com, rrajasek(a)redhat.com,
rsynek(a)redhat.com, rwagner(a)redhat.com,
rzhang(a)redhat.com, sclewis(a)redhat.com,
sdaley(a)redhat.com, slinaber(a)redhat.com,
sthorger(a)redhat.com, tcunning(a)redhat.com,
tdecacqu(a)redhat.com, tjay(a)redhat.com,
tkirby(a)redhat.com, tsanders(a)redhat.com,
vhalbert(a)redhat.com
The Commandline class in plexus-utils before 3.0.16 is vulnerable to command
injection because it does not correctly process the contents of double quoted
strings.
References:
https://nvd.nist.gov/vuln/detail/CVE-2017-1000487
https://github.com/codehaus-plexus/plexus-utils/commit/b38a1b3a4352303e43...
https://snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSPLEXUS-31522
--
You are receiving this mail because:
You are on the CC list for the bug.