Security
Headlines
HeadlinesLatestCVEs

Headline

Red Hat Security Advisory 2022-4798-01

Red Hat Security Advisory 2022-4798-01 - The Apache Maven Shared Utils project aims to be an improved functional replacement for plexus-utils in Maven. Issues addressed include a code execution vulnerability.

Packet Storm
Open in Source
#vulnerability#google#linux#red_hat#apache#js#java#maven

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

====================================================================
Red Hat Security Advisory

Synopsis: Important: maven:3.5 security update
Advisory ID: RHSA-2022:4798-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2022:4798
Issue date: 2022-05-30
CVE Names: CVE-2022-29599
====================================================================

  1. Summary:

An update for the maven:3.5 module is now available for Red Hat Enterprise
Linux 8, Red Hat Enterprise Linux 8.2 Extended Update Support, and Red Hat
Enterprise Linux 8.4 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

  1. Relevant releases/architectures:

Red Hat Enterprise Linux AppStream (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64
Red Hat Enterprise Linux AppStream EUS (v. 8.2) - aarch64, noarch, ppc64le, s390x, x86_64
Red Hat Enterprise Linux AppStream EUS (v.8.4) - aarch64, noarch, ppc64le, s390x, x86_64

  1. Description:

The Apache Maven Shared Utils project aims to be an improved functional
replacement for plexus-utils in Maven.

Security Fix(es):

  • maven-shared-utils: Command injection via Commandline class
    (CVE-2022-29599)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

  1. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

  1. Bugs fixed (https://bugzilla.redhat.com/):

2066479 - CVE-2022-29599 maven-shared-utils: Command injection via Commandline class

  1. Package List:

Red Hat Enterprise Linux AppStream EUS (v. 8.2):

Source:
aopalliance-1.0-17.module+el8+2452+b359bfcd.src.rpm
apache-commons-cli-1.4-4.module+el8+2452+b359bfcd.src.rpm
apache-commons-codec-1.11-3.module+el8+2452+b359bfcd.src.rpm
apache-commons-io-2.6-3.module+el8+2452+b359bfcd.src.rpm
apache-commons-lang3-3.7-3.module+el8+2452+b359bfcd.src.rpm
apache-commons-logging-1.2-13.module+el8+2452+b359bfcd.src.rpm
atinject-1-28.20100611svn86.module+el8+2452+b359bfcd.src.rpm
cdi-api-1.2-8.module+el8+2452+b359bfcd.src.rpm
geronimo-annotation-1.0-23.module+el8+2452+b359bfcd.src.rpm
glassfish-el-3.0.1-0.7.b08.module+el8+2452+b359bfcd.src.rpm
google-guice-4.1-11.module+el8+2452+b359bfcd.src.rpm
guava20-20.0-8.module+el8+2452+b359bfcd.src.rpm
hawtjni-1.16-2.module+el8+2452+b359bfcd.src.rpm
httpcomponents-client-4.5.5-4.module+el8+2452+b359bfcd.src.rpm
httpcomponents-core-4.4.10-3.module+el8+2452+b359bfcd.src.rpm
jansi-1.17.1-1.module+el8+2452+b359bfcd.src.rpm
jansi-native-1.7-7.module+el8+2452+b359bfcd.src.rpm
jboss-interceptors-1.2-api-1.0.0-8.module+el8+2452+b359bfcd.src.rpm
jsoup-1.11.3-3.module+el8+2452+b359bfcd.src.rpm
maven-3.5.4-5.module+el8+2452+b359bfcd.src.rpm
maven-resolver-1.1.1-2.module+el8+2452+b359bfcd.src.rpm
maven-shared-utils-3.2.1-0.2.module+el8.2.0+15046+b52d227a.src.rpm
maven-wagon-3.1.0-1.module+el8+2452+b359bfcd.src.rpm
plexus-cipher-1.7-14.module+el8+2452+b359bfcd.src.rpm
plexus-classworlds-2.5.2-9.module+el8+2452+b359bfcd.src.rpm
plexus-containers-1.7.1-8.module+el8+2452+b359bfcd.src.rpm
plexus-interpolation-1.22-9.module+el8+2452+b359bfcd.src.rpm
plexus-sec-dispatcher-1.4-26.module+el8+2452+b359bfcd.src.rpm
plexus-utils-3.1.0-3.module+el8+2452+b359bfcd.src.rpm
sisu-0.3.3-6.module+el8+2452+b359bfcd.src.rpm
slf4j-1.7.25-4.module+el8+2452+b359bfcd.src.rpm

aarch64:
jansi-native-1.7-7.module+el8+2452+b359bfcd.aarch64.rpm

noarch:
aopalliance-1.0-17.module+el8+2452+b359bfcd.noarch.rpm
apache-commons-cli-1.4-4.module+el8+2452+b359bfcd.noarch.rpm
apache-commons-codec-1.11-3.module+el8+2452+b359bfcd.noarch.rpm
apache-commons-io-2.6-3.module+el8+2452+b359bfcd.noarch.rpm
apache-commons-lang3-3.7-3.module+el8+2452+b359bfcd.noarch.rpm
apache-commons-logging-1.2-13.module+el8+2452+b359bfcd.noarch.rpm
atinject-1-28.20100611svn86.module+el8+2452+b359bfcd.noarch.rpm
cdi-api-1.2-8.module+el8+2452+b359bfcd.noarch.rpm
geronimo-annotation-1.0-23.module+el8+2452+b359bfcd.noarch.rpm
glassfish-el-api-3.0.1-0.7.b08.module+el8+2452+b359bfcd.noarch.rpm
google-guice-4.1-11.module+el8+2452+b359bfcd.noarch.rpm
guava20-20.0-8.module+el8+2452+b359bfcd.noarch.rpm
hawtjni-runtime-1.16-2.module+el8+2452+b359bfcd.noarch.rpm
httpcomponents-client-4.5.5-4.module+el8+2452+b359bfcd.noarch.rpm
httpcomponents-core-4.4.10-3.module+el8+2452+b359bfcd.noarch.rpm
jansi-1.17.1-1.module+el8+2452+b359bfcd.noarch.rpm
jboss-interceptors-1.2-api-1.0.0-8.module+el8+2452+b359bfcd.noarch.rpm
jcl-over-slf4j-1.7.25-4.module+el8+2452+b359bfcd.noarch.rpm
jsoup-1.11.3-3.module+el8+2452+b359bfcd.noarch.rpm
maven-3.5.4-5.module+el8+2452+b359bfcd.noarch.rpm
maven-lib-3.5.4-5.module+el8+2452+b359bfcd.noarch.rpm
maven-resolver-api-1.1.1-2.module+el8+2452+b359bfcd.noarch.rpm
maven-resolver-connector-basic-1.1.1-2.module+el8+2452+b359bfcd.noarch.rpm
maven-resolver-impl-1.1.1-2.module+el8+2452+b359bfcd.noarch.rpm
maven-resolver-spi-1.1.1-2.module+el8+2452+b359bfcd.noarch.rpm
maven-resolver-transport-wagon-1.1.1-2.module+el8+2452+b359bfcd.noarch.rpm
maven-resolver-util-1.1.1-2.module+el8+2452+b359bfcd.noarch.rpm
maven-shared-utils-3.2.1-0.2.module+el8.2.0+15046+b52d227a.noarch.rpm
maven-wagon-file-3.1.0-1.module+el8+2452+b359bfcd.noarch.rpm
maven-wagon-http-3.1.0-1.module+el8+2452+b359bfcd.noarch.rpm
maven-wagon-http-shared-3.1.0-1.module+el8+2452+b359bfcd.noarch.rpm
maven-wagon-provider-api-3.1.0-1.module+el8+2452+b359bfcd.noarch.rpm
plexus-cipher-1.7-14.module+el8+2452+b359bfcd.noarch.rpm
plexus-classworlds-2.5.2-9.module+el8+2452+b359bfcd.noarch.rpm
plexus-containers-component-annotations-1.7.1-8.module+el8+2452+b359bfcd.noarch.rpm
plexus-interpolation-1.22-9.module+el8+2452+b359bfcd.noarch.rpm
plexus-sec-dispatcher-1.4-26.module+el8+2452+b359bfcd.noarch.rpm
plexus-utils-3.1.0-3.module+el8+2452+b359bfcd.noarch.rpm
sisu-inject-0.3.3-6.module+el8+2452+b359bfcd.noarch.rpm
sisu-plexus-0.3.3-6.module+el8+2452+b359bfcd.noarch.rpm
slf4j-1.7.25-4.module+el8+2452+b359bfcd.noarch.rpm

ppc64le:
jansi-native-1.7-7.module+el8+2452+b359bfcd.ppc64le.rpm

s390x:
jansi-native-1.7-7.module+el8+2452+b359bfcd.s390x.rpm

x86_64:
jansi-native-1.7-7.module+el8+2452+b359bfcd.x86_64.rpm

Red Hat Enterprise Linux AppStream EUS (v.8.4):

Source:
aopalliance-1.0-17.module+el8+2452+b359bfcd.src.rpm
apache-commons-cli-1.4-4.module+el8+2452+b359bfcd.src.rpm
apache-commons-codec-1.11-3.module+el8+2452+b359bfcd.src.rpm
apache-commons-io-2.6-3.module+el8+2452+b359bfcd.src.rpm
apache-commons-lang3-3.7-3.module+el8+2452+b359bfcd.src.rpm
apache-commons-logging-1.2-13.module+el8+2452+b359bfcd.src.rpm
atinject-1-28.20100611svn86.module+el8+2452+b359bfcd.src.rpm
cdi-api-1.2-8.module+el8+2452+b359bfcd.src.rpm
geronimo-annotation-1.0-23.module+el8+2452+b359bfcd.src.rpm
glassfish-el-3.0.1-0.7.b08.module+el8+2452+b359bfcd.src.rpm
google-guice-4.1-11.module+el8+2452+b359bfcd.src.rpm
guava20-20.0-8.module+el8+2452+b359bfcd.src.rpm
hawtjni-1.16-2.module+el8+2452+b359bfcd.src.rpm
httpcomponents-client-4.5.5-4.module+el8+2452+b359bfcd.src.rpm
httpcomponents-core-4.4.10-3.module+el8+2452+b359bfcd.src.rpm
jansi-1.17.1-1.module+el8+2452+b359bfcd.src.rpm
jansi-native-1.7-7.module+el8+2452+b359bfcd.src.rpm
jboss-interceptors-1.2-api-1.0.0-8.module+el8+2452+b359bfcd.src.rpm
jsoup-1.11.3-3.module+el8+2452+b359bfcd.src.rpm
maven-3.5.4-5.module+el8+2452+b359bfcd.src.rpm
maven-resolver-1.1.1-2.module+el8+2452+b359bfcd.src.rpm
maven-shared-utils-3.2.1-0.2.module+el8.4.0+15140+8e8c2c6f.src.rpm
maven-wagon-3.1.0-1.module+el8+2452+b359bfcd.src.rpm
plexus-cipher-1.7-14.module+el8+2452+b359bfcd.src.rpm
plexus-classworlds-2.5.2-9.module+el8+2452+b359bfcd.src.rpm
plexus-containers-1.7.1-8.module+el8+2452+b359bfcd.src.rpm
plexus-interpolation-1.22-9.module+el8+2452+b359bfcd.src.rpm
plexus-sec-dispatcher-1.4-26.module+el8+2452+b359bfcd.src.rpm
plexus-utils-3.1.0-3.module+el8+2452+b359bfcd.src.rpm
sisu-0.3.3-6.module+el8+2452+b359bfcd.src.rpm
slf4j-1.7.25-4.module+el8+2452+b359bfcd.src.rpm

aarch64:
jansi-native-1.7-7.module+el8+2452+b359bfcd.aarch64.rpm

noarch:
aopalliance-1.0-17.module+el8+2452+b359bfcd.noarch.rpm
apache-commons-cli-1.4-4.module+el8+2452+b359bfcd.noarch.rpm
apache-commons-codec-1.11-3.module+el8+2452+b359bfcd.noarch.rpm
apache-commons-io-2.6-3.module+el8+2452+b359bfcd.noarch.rpm
apache-commons-lang3-3.7-3.module+el8+2452+b359bfcd.noarch.rpm
apache-commons-logging-1.2-13.module+el8+2452+b359bfcd.noarch.rpm
atinject-1-28.20100611svn86.module+el8+2452+b359bfcd.noarch.rpm
cdi-api-1.2-8.module+el8+2452+b359bfcd.noarch.rpm
geronimo-annotation-1.0-23.module+el8+2452+b359bfcd.noarch.rpm
glassfish-el-api-3.0.1-0.7.b08.module+el8+2452+b359bfcd.noarch.rpm
google-guice-4.1-11.module+el8+2452+b359bfcd.noarch.rpm
guava20-20.0-8.module+el8+2452+b359bfcd.noarch.rpm
hawtjni-runtime-1.16-2.module+el8+2452+b359bfcd.noarch.rpm
httpcomponents-client-4.5.5-4.module+el8+2452+b359bfcd.noarch.rpm
httpcomponents-core-4.4.10-3.module+el8+2452+b359bfcd.noarch.rpm
jansi-1.17.1-1.module+el8+2452+b359bfcd.noarch.rpm
jboss-interceptors-1.2-api-1.0.0-8.module+el8+2452+b359bfcd.noarch.rpm
jcl-over-slf4j-1.7.25-4.module+el8+2452+b359bfcd.noarch.rpm
jsoup-1.11.3-3.module+el8+2452+b359bfcd.noarch.rpm
maven-3.5.4-5.module+el8+2452+b359bfcd.noarch.rpm
maven-lib-3.5.4-5.module+el8+2452+b359bfcd.noarch.rpm
maven-resolver-api-1.1.1-2.module+el8+2452+b359bfcd.noarch.rpm
maven-resolver-connector-basic-1.1.1-2.module+el8+2452+b359bfcd.noarch.rpm
maven-resolver-impl-1.1.1-2.module+el8+2452+b359bfcd.noarch.rpm
maven-resolver-spi-1.1.1-2.module+el8+2452+b359bfcd.noarch.rpm
maven-resolver-transport-wagon-1.1.1-2.module+el8+2452+b359bfcd.noarch.rpm
maven-resolver-util-1.1.1-2.module+el8+2452+b359bfcd.noarch.rpm
maven-shared-utils-3.2.1-0.2.module+el8.4.0+15140+8e8c2c6f.noarch.rpm
maven-wagon-file-3.1.0-1.module+el8+2452+b359bfcd.noarch.rpm
maven-wagon-http-3.1.0-1.module+el8+2452+b359bfcd.noarch.rpm
maven-wagon-http-shared-3.1.0-1.module+el8+2452+b359bfcd.noarch.rpm
maven-wagon-provider-api-3.1.0-1.module+el8+2452+b359bfcd.noarch.rpm
plexus-cipher-1.7-14.module+el8+2452+b359bfcd.noarch.rpm
plexus-classworlds-2.5.2-9.module+el8+2452+b359bfcd.noarch.rpm
plexus-containers-component-annotations-1.7.1-8.module+el8+2452+b359bfcd.noarch.rpm
plexus-interpolation-1.22-9.module+el8+2452+b359bfcd.noarch.rpm
plexus-sec-dispatcher-1.4-26.module+el8+2452+b359bfcd.noarch.rpm
plexus-utils-3.1.0-3.module+el8+2452+b359bfcd.noarch.rpm
sisu-inject-0.3.3-6.module+el8+2452+b359bfcd.noarch.rpm
sisu-plexus-0.3.3-6.module+el8+2452+b359bfcd.noarch.rpm
slf4j-1.7.25-4.module+el8+2452+b359bfcd.noarch.rpm

ppc64le:
jansi-native-1.7-7.module+el8+2452+b359bfcd.ppc64le.rpm

s390x:
jansi-native-1.7-7.module+el8+2452+b359bfcd.s390x.rpm

x86_64:
jansi-native-1.7-7.module+el8+2452+b359bfcd.x86_64.rpm

Red Hat Enterprise Linux AppStream (v. 8):

Source:
aopalliance-1.0-17.module+el8+2452+b359bfcd.src.rpm
apache-commons-cli-1.4-4.module+el8+2452+b359bfcd.src.rpm
apache-commons-codec-1.11-3.module+el8+2452+b359bfcd.src.rpm
apache-commons-io-2.6-3.module+el8+2452+b359bfcd.src.rpm
apache-commons-lang3-3.7-3.module+el8+2452+b359bfcd.src.rpm
apache-commons-logging-1.2-13.module+el8+2452+b359bfcd.src.rpm
atinject-1-28.20100611svn86.module+el8+2452+b359bfcd.src.rpm
cdi-api-1.2-8.module+el8+2452+b359bfcd.src.rpm
geronimo-annotation-1.0-23.module+el8+2452+b359bfcd.src.rpm
glassfish-el-3.0.1-0.7.b08.module+el8+2452+b359bfcd.src.rpm
google-guice-4.1-11.module+el8+2452+b359bfcd.src.rpm
guava20-20.0-8.module+el8+2452+b359bfcd.src.rpm
hawtjni-1.16-2.module+el8+2452+b359bfcd.src.rpm
httpcomponents-client-4.5.5-5.module+el8.6.0+13298+7b5243c0.src.rpm
httpcomponents-core-4.4.10-3.module+el8+2452+b359bfcd.src.rpm
jansi-1.17.1-1.module+el8+2452+b359bfcd.src.rpm
jansi-native-1.7-7.module+el8+2452+b359bfcd.src.rpm
jboss-interceptors-1.2-api-1.0.0-8.module+el8+2452+b359bfcd.src.rpm
jsoup-1.11.3-3.module+el8+2452+b359bfcd.src.rpm
maven-3.5.4-5.module+el8+2452+b359bfcd.src.rpm
maven-resolver-1.1.1-2.module+el8+2452+b359bfcd.src.rpm
maven-shared-utils-3.2.1-0.2.module+el8.6.0+15045+b1156105.src.rpm
maven-wagon-3.1.0-1.module+el8+2452+b359bfcd.src.rpm
plexus-cipher-1.7-14.module+el8+2452+b359bfcd.src.rpm
plexus-classworlds-2.5.2-9.module+el8+2452+b359bfcd.src.rpm
plexus-containers-1.7.1-8.module+el8+2452+b359bfcd.src.rpm
plexus-interpolation-1.22-9.module+el8+2452+b359bfcd.src.rpm
plexus-sec-dispatcher-1.4-26.module+el8+2452+b359bfcd.src.rpm
plexus-utils-3.1.0-3.module+el8+2452+b359bfcd.src.rpm
sisu-0.3.3-6.module+el8+2452+b359bfcd.src.rpm
slf4j-1.7.25-4.module+el8+2452+b359bfcd.src.rpm

aarch64:
jansi-native-1.7-7.module+el8+2452+b359bfcd.aarch64.rpm

noarch:
aopalliance-1.0-17.module+el8+2452+b359bfcd.noarch.rpm
apache-commons-cli-1.4-4.module+el8+2452+b359bfcd.noarch.rpm
apache-commons-codec-1.11-3.module+el8+2452+b359bfcd.noarch.rpm
apache-commons-io-2.6-3.module+el8+2452+b359bfcd.noarch.rpm
apache-commons-lang3-3.7-3.module+el8+2452+b359bfcd.noarch.rpm
apache-commons-logging-1.2-13.module+el8+2452+b359bfcd.noarch.rpm
atinject-1-28.20100611svn86.module+el8+2452+b359bfcd.noarch.rpm
cdi-api-1.2-8.module+el8+2452+b359bfcd.noarch.rpm
geronimo-annotation-1.0-23.module+el8+2452+b359bfcd.noarch.rpm
glassfish-el-api-3.0.1-0.7.b08.module+el8+2452+b359bfcd.noarch.rpm
google-guice-4.1-11.module+el8+2452+b359bfcd.noarch.rpm
guava20-20.0-8.module+el8+2452+b359bfcd.noarch.rpm
hawtjni-runtime-1.16-2.module+el8+2452+b359bfcd.noarch.rpm
httpcomponents-client-4.5.5-5.module+el8.6.0+13298+7b5243c0.noarch.rpm
httpcomponents-core-4.4.10-3.module+el8+2452+b359bfcd.noarch.rpm
jansi-1.17.1-1.module+el8+2452+b359bfcd.noarch.rpm
jboss-interceptors-1.2-api-1.0.0-8.module+el8+2452+b359bfcd.noarch.rpm
jcl-over-slf4j-1.7.25-4.module+el8+2452+b359bfcd.noarch.rpm
jsoup-1.11.3-3.module+el8+2452+b359bfcd.noarch.rpm
maven-3.5.4-5.module+el8+2452+b359bfcd.noarch.rpm
maven-lib-3.5.4-5.module+el8+2452+b359bfcd.noarch.rpm
maven-resolver-api-1.1.1-2.module+el8+2452+b359bfcd.noarch.rpm
maven-resolver-connector-basic-1.1.1-2.module+el8+2452+b359bfcd.noarch.rpm
maven-resolver-impl-1.1.1-2.module+el8+2452+b359bfcd.noarch.rpm
maven-resolver-spi-1.1.1-2.module+el8+2452+b359bfcd.noarch.rpm
maven-resolver-transport-wagon-1.1.1-2.module+el8+2452+b359bfcd.noarch.rpm
maven-resolver-util-1.1.1-2.module+el8+2452+b359bfcd.noarch.rpm
maven-shared-utils-3.2.1-0.2.module+el8.6.0+15045+b1156105.noarch.rpm
maven-wagon-file-3.1.0-1.module+el8+2452+b359bfcd.noarch.rpm
maven-wagon-http-3.1.0-1.module+el8+2452+b359bfcd.noarch.rpm
maven-wagon-http-shared-3.1.0-1.module+el8+2452+b359bfcd.noarch.rpm
maven-wagon-provider-api-3.1.0-1.module+el8+2452+b359bfcd.noarch.rpm
plexus-cipher-1.7-14.module+el8+2452+b359bfcd.noarch.rpm
plexus-classworlds-2.5.2-9.module+el8+2452+b359bfcd.noarch.rpm
plexus-containers-component-annotations-1.7.1-8.module+el8+2452+b359bfcd.noarch.rpm
plexus-interpolation-1.22-9.module+el8+2452+b359bfcd.noarch.rpm
plexus-sec-dispatcher-1.4-26.module+el8+2452+b359bfcd.noarch.rpm
plexus-utils-3.1.0-3.module+el8+2452+b359bfcd.noarch.rpm
sisu-inject-0.3.3-6.module+el8+2452+b359bfcd.noarch.rpm
sisu-plexus-0.3.3-6.module+el8+2452+b359bfcd.noarch.rpm
slf4j-1.7.25-4.module+el8+2452+b359bfcd.noarch.rpm

ppc64le:
jansi-native-1.7-7.module+el8+2452+b359bfcd.ppc64le.rpm

s390x:
jansi-native-1.7-7.module+el8+2452+b359bfcd.s390x.rpm

x86_64:
jansi-native-1.7-7.module+el8+2452+b359bfcd.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

  1. References:

https://access.redhat.com/security/cve/CVE-2022-29599
https://access.redhat.com/security/updates/classification/#important

  1. Contact:

The Red Hat security contact is [email protected]. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYpTSItzjgjWX9erEAQgEJw/+NfjxsrVuNmYIQAd4uZq601LhJyZYw3Lh
ZGSBRBUDpy9oLwFu5qTpOMO1Tvowuw5uuZ6c69+rOXBGdEUJXoKN9NB904vXdj+K
vlZm+Iah49MNc9R8P/UScOCENlRUCj+ZDpMOzVxZowHf7TNuC10BLoJdoMyW4OtS
u1J91WkpHfhg2M5Pw1hwFsbMrdLZPiPFjQyrW+972OPo9MHr1jx8g+hkaRPQyF4k
7Dk4+YAVpjPAMqsDbpr32NfEOenHO7g6GtlPLwiWNc+gEb6+xtxwYlRXw/mTRIPL
syh2eCPJdHHc2AqEVpSeAJfulbZ8tjQaf1kcLZQJ9ViSM0FqzsPDt6IrLGwYbZqQ
/l1WyCRFOKEBS+1BrW4WlGRB6SqW3L0kiVd8DoRWByz2NNvL8ACMuSIDuUbwdWOn
/PZzk3KAX43VFxZBXv3123s+7tPSthBlsLMjOZ1aPLq/9ituUyRsye/iVjdQ7yHH
egTRACDNv9V//1veX4UBMbiFJBj1USkYreEuNIgEVUkMGe7wGXzGY11PDwcAeD5l
jVL5vxP6uq9a46HDpTovI/Dm+1WCjzLGuwe4y8prlFuG3bbJRi4qTAyVcji7SGsY
NHu1mj5J+LE6VaQIo3xXBenK2M+MnSMaRpp7hW5KdWElBZhZ3ulhLUaAMSo/fbgv
GpHNg6vNdC8=mm5z
-----END PGP SIGNATURE-----
–
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Related news

Red Hat Security Advisory 2024-0778-03

Red Hat Security Advisory 2024-0778-03 - An update for Jenkins and Jenkins-2-plugins is now available for OpenShift Developer Tools and Services for OCP 4.12. Issues addressed include bypass, code execution, cross site request forgery, cross site scripting, denial of service, improper authorization, information leakage, insecure permissions, and open redirection vulnerabilities.

Red Hat Security Advisory 2024-0777-03

Red Hat Security Advisory 2024-0777-03 - An update for jenkins and jenkins-2-plugins is now available for OpenShift Developer Tools and Services for OCP 4.14. Issues addressed include bypass, code execution, cross site request forgery, cross site scripting, denial of service, information leakage, and open redirection vulnerabilities.

CVE-2023-22130: Oracle Critical Patch Update Advisory - October 2023

Vulnerability in the Sun ZFS Storage Appliance product of Oracle Systems (component: Core). The supported version that is affected is 8.8.60. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Sun ZFS Storage Appliance. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Sun ZFS Storage Appliance. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).

Red Hat Security Advisory 2023-3622-01

Red Hat Security Advisory 2023-3622-01 - Jenkins is a continuous integration server that monitors executions of repeated jobs, such as building a software project or jobs run by cron. Issues addressed include bypass, code execution, cross site request forgery, denial of service, information leakage, insecure permissions, and resource exhaustion vulnerabilities.

RHSA-2023:3622: Red Hat Security Advisory: jenkins and jenkins-2-plugins security update

An update for jenkins and jenkins-2-plugins is now available for OpenShift Developer Tools and Services for OCP 4.13. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-29599: A flaw was found in the maven-shared-utils package. This issue allows a Command Injection due to improper escaping, allowing a shell injection attack. * CVE-2022-30953: A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.25.3 and earlier allows attackers to connect to an...

RHSA-2023:3610: Red Hat Security Advisory: jenkins and jenkins-2-plugins security update

An update for jenkins and jenkins-2-plugins is now available for OpenShift Developer Tools and Services for OCP 4.12. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-46877: A flaw was found in Jackson Databind. This issue may allow a malicious user to cause a denial of service (2 GB transient heap usage per read) in uncommon situations involving JsonNode JDK serialization. * CVE-2022-29599: A flaw was found in the maven-shared-utils package. This issue allows a Command...

Red Hat Security Advisory 2023-3198-01

Red Hat Security Advisory 2023-3198-01 - Jenkins is a continuous integration server that monitors executions of repeated jobs, such as building a software project or jobs run by cron. Issues addressed include bypass, code execution, cross site request forgery, cross site scripting, denial of service, deserialization, information leakage, and insecure permissions vulnerabilities.

RHSA-2023:3198: Red Hat Security Advisory: jenkins and jenkins-2-plugins security update

An update for jenkins and jenkins-2-plugins is now available for OpenShift Developer Tools and Services for OCP 4.11. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-26291: A flaw was found in maven. Repositories that are defined in a dependency’s Project Object Model (pom), which may be unknown to users, are used by default resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that r...

CVE-2023-21954: Oracle Critical Patch Update Advisory - April 2023

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through...

RHSA-2023:0573: Red Hat Security Advisory: OpenShift Container Platform 4.9.55 security update

Red Hat OpenShift Container Platform release 4.9.55 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-29599: A flaw was found in the maven-shared-utils package. This issue allows a Command Injection due to improper escaping, allowing a shell injection attack.

Red Hat Security Advisory 2022-9098-01

Red Hat Security Advisory 2022-9098-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.10.46. Issues addressed include a code execution vulnerability.

RHSA-2022:9098: Red Hat Security Advisory: OpenShift Container Platform 4.10.46 packages and security update

Red Hat OpenShift Container Platform release 4.10.46 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-29599: maven-shared-utils: Command injection via Commandline class

Red Hat Security Advisory 2022-2281-01

Red Hat Security Advisory 2022-2281-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 3.11.705.

Red Hat Security Advisory 2022-4797-01

Red Hat Security Advisory 2022-4797-01 - The Apache Maven Shared Utils project aims to be an improved functional replacement for plexus-utils in Maven. Issues addressed include a code execution vulnerability.

RHSA-2022:2281: Red Hat Security Advisory: OpenShift Container Platform 3.11.705 security update

Red Hat OpenShift Container Platform release 3.11.705 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 3.11. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-1677: openshift/router: route hijacking attack via crafted HAProxy configuration file

RHSA-2022:4798: Red Hat Security Advisory: maven:3.5 security update

An update for the maven:3.5 module is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.2 Extended Update Support, and Red Hat Enterprise Linux 8.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-29599: maven-shared-utils: Command injection via Commandline class

RHSA-2022:4797: Red Hat Security Advisory: maven:3.6 security update

An update for the maven:3.6 module is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.2 Extended Update Support, and Red Hat Enterprise Linux 8.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-29599: maven-shared-utils: Command injection via Commandline class

Red Hat Security Advisory 2022-4699-01

Red Hat Security Advisory 2022-4699-01 - The Apache Maven Shared Utils project aims to be an improved functional replacement for plexus-utils in Maven. Issues addressed include a code execution vulnerability.

RHSA-2022:4699: Red Hat Security Advisory: maven:3.5 security update

An update for the maven:3.5 module is now available for Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-29599: maven-shared-utils: Command injection via Commandline class

CVE-2022-29599: [MSHARED-297] Unconditionally single quote executable and arguments by roxspring · Pull Request #40 · apache/maven-shared-utils

In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks.

Packet Storm: Latest News

Acronis Cyber Protect/Backup Remote Code Execution
Packet Storm