ALAS2-2022-1794 --- maven-shared-utilsID: oval:org.secpod.oval:def:1700910 | Date: (C)2022-05-10 (M)2024-04-29 |
Class: PATCH | Family: unix |
org.apache.maven.shared:maven-shared-utils is a functional replacement for plexus-utils in Maven. Affected versions of this package are vulnerable to Command Injection. The Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks. The BourneShell class should unconditionally single-quote emitted strings , with {{'"'"'}} used for embedded single quotes, for maximum safety across shells implementing a superset of POSIX quoting rules
Product: |
maven-shared-utils |