Security
Headlines
HeadlinesLatestCVEs

Headline

Red Hat Security Advisory 2022-4797-01

Red Hat Security Advisory 2022-4797-01 - The Apache Maven Shared Utils project aims to be an improved functional replacement for plexus-utils in Maven. Issues addressed include a code execution vulnerability.

Packet Storm
Open in Source
#vulnerability#google#linux#red_hat#apache#nodejs#js#java#maven

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Important: maven:3.6 security update
Advisory ID: RHSA-2022:4797-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2022:4797
Issue date: 2022-05-30
CVE Names: CVE-2022-29599
=====================================================================

  1. Summary:

An update for the maven:3.6 module is now available for Red Hat Enterprise
Linux 8, Red Hat Enterprise Linux 8.2 Extended Update Support, and Red Hat
Enterprise Linux 8.4 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

  1. Relevant releases/architectures:

Red Hat Enterprise Linux AppStream (v. 8) - noarch
Red Hat Enterprise Linux AppStream EUS (v. 8.2) - noarch
Red Hat Enterprise Linux AppStream EUS (v.8.4) - noarch

  1. Description:

The Apache Maven Shared Utils project aims to be an improved functional
replacement for plexus-utils in Maven.

Security Fix(es):

  • maven-shared-utils: Command injection via Commandline class
    (CVE-2022-29599)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

  1. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

  1. Bugs fixed (https://bugzilla.redhat.com/):

2066479 - CVE-2022-29599 maven-shared-utils: Command injection via Commandline class

  1. Package List:

Red Hat Enterprise Linux AppStream EUS (v. 8.2):

Source:
aopalliance-1.0-20.module+el8.2.0+5557+11a14461.src.rpm
apache-commons-cli-1.4-7.module+el8.2.0+5557+11a14461.src.rpm
apache-commons-codec-1.13-3.module+el8.2.0+5557+11a14461.src.rpm
apache-commons-io-2.6-6.module+el8.2.0+5557+11a14461.src.rpm
apache-commons-lang3-3.9-4.module+el8.2.0+5557+11a14461.src.rpm
atinject-1-31.20100611svn86.module+el8.2.0+5557+11a14461.src.rpm
cdi-api-2.0.1-3.module+el8.2.0+5557+11a14461.src.rpm
geronimo-annotation-1.0-26.module+el8.2.0+5557+11a14461.src.rpm
google-guice-4.2.2-4.module+el8.2.0+5557+11a14461.src.rpm
guava-28.1-3.module+el8.2.0+5557+11a14461.src.rpm
httpcomponents-client-4.5.10-3.module+el8.2.0+5557+11a14461.src.rpm
httpcomponents-core-4.4.12-3.module+el8.2.0+5557+11a14461.src.rpm
jansi-1.18-4.module+el8.2.0+5557+11a14461.src.rpm
jsoup-1.12.1-3.module+el8.2.0+5557+11a14461.src.rpm
jsr-305-0-0.25.20130910svn.module+el8.2.0+5557+11a14461.src.rpm
maven-3.6.2-4.module+el8.2.0+5560+b953ed0b.src.rpm
maven-resolver-1.4.1-3.module+el8.2.0+5557+11a14461.src.rpm
maven-shared-utils-3.2.1-0.5.module+el8.2.0+15047+acf0c170.src.rpm
maven-wagon-3.3.4-2.module+el8.2.0+5557+11a14461.src.rpm
plexus-cipher-1.7-17.module+el8.2.0+5557+11a14461.src.rpm
plexus-classworlds-2.6.0-4.module+el8.2.0+5557+11a14461.src.rpm
plexus-containers-2.1.0-2.module+el8.2.0+5557+11a14461.src.rpm
plexus-interpolation-1.26-3.module+el8.2.0+5557+11a14461.src.rpm
plexus-sec-dispatcher-1.4-29.module+el8.2.0+5557+11a14461.src.rpm
plexus-utils-3.3.0-3.module+el8.2.0+5557+11a14461.src.rpm
sisu-0.3.4-2.module+el8.2.0+5557+11a14461.src.rpm
slf4j-1.7.28-3.module+el8.2.0+5557+11a14461.src.rpm

noarch:
aopalliance-1.0-20.module+el8.2.0+5557+11a14461.noarch.rpm
apache-commons-cli-1.4-7.module+el8.2.0+5557+11a14461.noarch.rpm
apache-commons-codec-1.13-3.module+el8.2.0+5557+11a14461.noarch.rpm
apache-commons-io-2.6-6.module+el8.2.0+5557+11a14461.noarch.rpm
apache-commons-lang3-3.9-4.module+el8.2.0+5557+11a14461.noarch.rpm
atinject-1-31.20100611svn86.module+el8.2.0+5557+11a14461.noarch.rpm
cdi-api-2.0.1-3.module+el8.2.0+5557+11a14461.noarch.rpm
geronimo-annotation-1.0-26.module+el8.2.0+5557+11a14461.noarch.rpm
google-guice-4.2.2-4.module+el8.2.0+5557+11a14461.noarch.rpm
guava-28.1-3.module+el8.2.0+5557+11a14461.noarch.rpm
httpcomponents-client-4.5.10-3.module+el8.2.0+5557+11a14461.noarch.rpm
httpcomponents-core-4.4.12-3.module+el8.2.0+5557+11a14461.noarch.rpm
jansi-1.18-4.module+el8.2.0+5557+11a14461.noarch.rpm
jcl-over-slf4j-1.7.28-3.module+el8.2.0+5557+11a14461.noarch.rpm
jsoup-1.12.1-3.module+el8.2.0+5557+11a14461.noarch.rpm
jsr-305-0-0.25.20130910svn.module+el8.2.0+5557+11a14461.noarch.rpm
maven-3.6.2-4.module+el8.2.0+5560+b953ed0b.noarch.rpm
maven-lib-3.6.2-4.module+el8.2.0+5560+b953ed0b.noarch.rpm
maven-openjdk11-3.6.2-4.module+el8.2.0+5560+b953ed0b.noarch.rpm
maven-openjdk8-3.6.2-4.module+el8.2.0+5560+b953ed0b.noarch.rpm
maven-resolver-1.4.1-3.module+el8.2.0+5557+11a14461.noarch.rpm
maven-shared-utils-3.2.1-0.5.module+el8.2.0+15047+acf0c170.noarch.rpm
maven-wagon-3.3.4-2.module+el8.2.0+5557+11a14461.noarch.rpm
plexus-cipher-1.7-17.module+el8.2.0+5557+11a14461.noarch.rpm
plexus-classworlds-2.6.0-4.module+el8.2.0+5557+11a14461.noarch.rpm
plexus-containers-component-annotations-2.1.0-2.module+el8.2.0+5557+11a14461.noarch.rpm
plexus-interpolation-1.26-3.module+el8.2.0+5557+11a14461.noarch.rpm
plexus-sec-dispatcher-1.4-29.module+el8.2.0+5557+11a14461.noarch.rpm
plexus-utils-3.3.0-3.module+el8.2.0+5557+11a14461.noarch.rpm
sisu-0.3.4-2.module+el8.2.0+5557+11a14461.noarch.rpm
slf4j-1.7.28-3.module+el8.2.0+5557+11a14461.noarch.rpm

Red Hat Enterprise Linux AppStream EUS (v.8.4):

Source:
aopalliance-1.0-20.module+el8.3.0+6804+157bd82e.src.rpm
apache-commons-cli-1.4-7.module+el8.3.0+6804+157bd82e.src.rpm
apache-commons-codec-1.13-3.module+el8.3.0+6804+157bd82e.src.rpm
apache-commons-io-2.6-6.module+el8.3.0+6804+157bd82e.src.rpm
apache-commons-lang3-3.9-4.module+el8.3.0+6804+157bd82e.src.rpm
atinject-1-31.20100611svn86.module+el8.3.0+6804+157bd82e.src.rpm
cdi-api-2.0.1-3.module+el8.3.0+6804+157bd82e.src.rpm
geronimo-annotation-1.0-26.module+el8.3.0+6804+157bd82e.src.rpm
google-guice-4.2.2-4.module+el8.3.0+6804+157bd82e.src.rpm
guava-28.1-3.module+el8.3.0+6804+157bd82e.src.rpm
httpcomponents-client-4.5.10-3.module+el8.3.0+6804+157bd82e.src.rpm
httpcomponents-core-4.4.12-3.module+el8.3.0+6804+157bd82e.src.rpm
jansi-1.18-4.module+el8.3.0+6804+157bd82e.src.rpm
jsoup-1.12.1-3.module+el8.3.0+6804+157bd82e.src.rpm
jsr-305-0-0.25.20130910svn.module+el8.3.0+6804+157bd82e.src.rpm
maven-3.6.2-6.module+el8.4.0+9250+1786af37.src.rpm
maven-resolver-1.4.1-3.module+el8.3.0+6804+157bd82e.src.rpm
maven-shared-utils-3.2.1-0.5.module+el8.4.0+15048+bdaf849b.src.rpm
maven-wagon-3.3.4-2.module+el8.3.0+6804+157bd82e.src.rpm
plexus-cipher-1.7-17.module+el8.3.0+6804+157bd82e.src.rpm
plexus-classworlds-2.6.0-4.module+el8.3.0+6804+157bd82e.src.rpm
plexus-containers-2.1.0-2.module+el8.3.0+6804+157bd82e.src.rpm
plexus-interpolation-1.26-3.module+el8.3.0+6804+157bd82e.src.rpm
plexus-sec-dispatcher-1.4-29.module+el8.3.0+6804+157bd82e.src.rpm
plexus-utils-3.3.0-3.module+el8.3.0+6804+157bd82e.src.rpm
sisu-0.3.4-2.module+el8.3.0+6804+157bd82e.src.rpm
slf4j-1.7.28-3.module+el8.3.0+6804+157bd82e.src.rpm

noarch:
aopalliance-1.0-20.module+el8.3.0+6804+157bd82e.noarch.rpm
apache-commons-cli-1.4-7.module+el8.3.0+6804+157bd82e.noarch.rpm
apache-commons-codec-1.13-3.module+el8.3.0+6804+157bd82e.noarch.rpm
apache-commons-io-2.6-6.module+el8.3.0+6804+157bd82e.noarch.rpm
apache-commons-lang3-3.9-4.module+el8.3.0+6804+157bd82e.noarch.rpm
atinject-1-31.20100611svn86.module+el8.3.0+6804+157bd82e.noarch.rpm
cdi-api-2.0.1-3.module+el8.3.0+6804+157bd82e.noarch.rpm
geronimo-annotation-1.0-26.module+el8.3.0+6804+157bd82e.noarch.rpm
google-guice-4.2.2-4.module+el8.3.0+6804+157bd82e.noarch.rpm
guava-28.1-3.module+el8.3.0+6804+157bd82e.noarch.rpm
httpcomponents-client-4.5.10-3.module+el8.3.0+6804+157bd82e.noarch.rpm
httpcomponents-core-4.4.12-3.module+el8.3.0+6804+157bd82e.noarch.rpm
jansi-1.18-4.module+el8.3.0+6804+157bd82e.noarch.rpm
jcl-over-slf4j-1.7.28-3.module+el8.3.0+6804+157bd82e.noarch.rpm
jsoup-1.12.1-3.module+el8.3.0+6804+157bd82e.noarch.rpm
jsr-305-0-0.25.20130910svn.module+el8.3.0+6804+157bd82e.noarch.rpm
maven-3.6.2-6.module+el8.4.0+9250+1786af37.noarch.rpm
maven-lib-3.6.2-6.module+el8.4.0+9250+1786af37.noarch.rpm
maven-openjdk11-3.6.2-6.module+el8.4.0+9250+1786af37.noarch.rpm
maven-openjdk8-3.6.2-6.module+el8.4.0+9250+1786af37.noarch.rpm
maven-resolver-1.4.1-3.module+el8.3.0+6804+157bd82e.noarch.rpm
maven-shared-utils-3.2.1-0.5.module+el8.4.0+15048+bdaf849b.noarch.rpm
maven-wagon-3.3.4-2.module+el8.3.0+6804+157bd82e.noarch.rpm
plexus-cipher-1.7-17.module+el8.3.0+6804+157bd82e.noarch.rpm
plexus-classworlds-2.6.0-4.module+el8.3.0+6804+157bd82e.noarch.rpm
plexus-containers-component-annotations-2.1.0-2.module+el8.3.0+6804+157bd82e.noarch.rpm
plexus-interpolation-1.26-3.module+el8.3.0+6804+157bd82e.noarch.rpm
plexus-sec-dispatcher-1.4-29.module+el8.3.0+6804+157bd82e.noarch.rpm
plexus-utils-3.3.0-3.module+el8.3.0+6804+157bd82e.noarch.rpm
sisu-0.3.4-2.module+el8.3.0+6804+157bd82e.noarch.rpm
slf4j-1.7.28-3.module+el8.3.0+6804+157bd82e.noarch.rpm

Red Hat Enterprise Linux AppStream (v. 8):

Source:
aopalliance-1.0-20.module+el8.6.0+13337+afcb49ec.src.rpm
apache-commons-cli-1.4-7.module+el8.6.0+13337+afcb49ec.src.rpm
apache-commons-codec-1.13-3.module+el8.6.0+13337+afcb49ec.src.rpm
apache-commons-io-2.6-6.module+el8.6.0+13337+afcb49ec.src.rpm
apache-commons-lang3-3.9-4.module+el8.6.0+13337+afcb49ec.src.rpm
atinject-1-31.20100611svn86.module+el8.6.0+13337+afcb49ec.src.rpm
cdi-api-2.0.1-3.module+el8.6.0+13337+afcb49ec.src.rpm
geronimo-annotation-1.0-26.module+el8.6.0+13337+afcb49ec.src.rpm
google-guice-4.2.2-4.module+el8.6.0+13337+afcb49ec.src.rpm
guava-28.1-3.module+el8.6.0+13337+afcb49ec.src.rpm
httpcomponents-client-4.5.10-4.module+el8.6.0+13337+afcb49ec.src.rpm
httpcomponents-core-4.4.12-3.module+el8.6.0+13337+afcb49ec.src.rpm
jansi-1.18-4.module+el8.6.0+13337+afcb49ec.src.rpm
jsoup-1.12.1-3.module+el8.6.0+13337+afcb49ec.src.rpm
jsr-305-0-0.25.20130910svn.module+el8.6.0+13337+afcb49ec.src.rpm
maven-3.6.2-7.module+el8.6.0+13337+afcb49ec.src.rpm
maven-resolver-1.4.1-3.module+el8.6.0+13337+afcb49ec.src.rpm
maven-shared-utils-3.2.1-0.5.module+el8.6.0+15049+43453910.src.rpm
maven-wagon-3.3.4-2.module+el8.6.0+13337+afcb49ec.src.rpm
plexus-cipher-1.7-17.module+el8.6.0+13337+afcb49ec.src.rpm
plexus-classworlds-2.6.0-4.module+el8.6.0+13337+afcb49ec.src.rpm
plexus-containers-2.1.0-2.module+el8.6.0+13337+afcb49ec.src.rpm
plexus-interpolation-1.26-3.module+el8.6.0+13337+afcb49ec.src.rpm
plexus-sec-dispatcher-1.4-29.module+el8.6.0+13337+afcb49ec.src.rpm
plexus-utils-3.3.0-3.module+el8.6.0+13337+afcb49ec.src.rpm
sisu-0.3.4-2.module+el8.6.0+13337+afcb49ec.src.rpm
slf4j-1.7.28-3.module+el8.6.0+13337+afcb49ec.src.rpm

noarch:
aopalliance-1.0-20.module+el8.6.0+13337+afcb49ec.noarch.rpm
apache-commons-cli-1.4-7.module+el8.6.0+13337+afcb49ec.noarch.rpm
apache-commons-codec-1.13-3.module+el8.6.0+13337+afcb49ec.noarch.rpm
apache-commons-io-2.6-6.module+el8.6.0+13337+afcb49ec.noarch.rpm
apache-commons-lang3-3.9-4.module+el8.6.0+13337+afcb49ec.noarch.rpm
atinject-1-31.20100611svn86.module+el8.6.0+13337+afcb49ec.noarch.rpm
cdi-api-2.0.1-3.module+el8.6.0+13337+afcb49ec.noarch.rpm
geronimo-annotation-1.0-26.module+el8.6.0+13337+afcb49ec.noarch.rpm
google-guice-4.2.2-4.module+el8.6.0+13337+afcb49ec.noarch.rpm
guava-28.1-3.module+el8.6.0+13337+afcb49ec.noarch.rpm
httpcomponents-client-4.5.10-4.module+el8.6.0+13337+afcb49ec.noarch.rpm
httpcomponents-core-4.4.12-3.module+el8.6.0+13337+afcb49ec.noarch.rpm
jansi-1.18-4.module+el8.6.0+13337+afcb49ec.noarch.rpm
jcl-over-slf4j-1.7.28-3.module+el8.6.0+13337+afcb49ec.noarch.rpm
jsoup-1.12.1-3.module+el8.6.0+13337+afcb49ec.noarch.rpm
jsr-305-0-0.25.20130910svn.module+el8.6.0+13337+afcb49ec.noarch.rpm
maven-3.6.2-7.module+el8.6.0+13337+afcb49ec.noarch.rpm
maven-lib-3.6.2-7.module+el8.6.0+13337+afcb49ec.noarch.rpm
maven-openjdk11-3.6.2-7.module+el8.6.0+13337+afcb49ec.noarch.rpm
maven-openjdk17-3.6.2-7.module+el8.6.0+13337+afcb49ec.noarch.rpm
maven-openjdk8-3.6.2-7.module+el8.6.0+13337+afcb49ec.noarch.rpm
maven-resolver-1.4.1-3.module+el8.6.0+13337+afcb49ec.noarch.rpm
maven-shared-utils-3.2.1-0.5.module+el8.6.0+15049+43453910.noarch.rpm
maven-wagon-3.3.4-2.module+el8.6.0+13337+afcb49ec.noarch.rpm
plexus-cipher-1.7-17.module+el8.6.0+13337+afcb49ec.noarch.rpm
plexus-classworlds-2.6.0-4.module+el8.6.0+13337+afcb49ec.noarch.rpm
plexus-containers-component-annotations-2.1.0-2.module+el8.6.0+13337+afcb49ec.noarch.rpm
plexus-interpolation-1.26-3.module+el8.6.0+13337+afcb49ec.noarch.rpm
plexus-sec-dispatcher-1.4-29.module+el8.6.0+13337+afcb49ec.noarch.rpm
plexus-utils-3.3.0-3.module+el8.6.0+13337+afcb49ec.noarch.rpm
sisu-0.3.4-2.module+el8.6.0+13337+afcb49ec.noarch.rpm
slf4j-1.7.28-3.module+el8.6.0+13337+afcb49ec.noarch.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

  1. References:

https://access.redhat.com/security/cve/CVE-2022-29599
https://access.redhat.com/security/updates/classification/#important

  1. Contact:

The Red Hat security contact is [email protected]. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYpTSBNzjgjWX9erEAQiJ1xAAkYmSMa4bJ5b6iRezcg6+upucDSznAYBj
XKcomZR/XXwJ+nnDhzn8qiF20KNIBObUkmSiSpBuTCMAf4EH2qXgQAh+WM3Endfo
ISUulqNPMwuexVCOOdp1QEjfXNGocxXKRF83FPSQjqNTh3pFmvRjFWGnMHOHs1UP
OMOT/urpxB/2dKFUzA2fxhdj2kIumTON71Ixt55rmOpX+1/DMMoSDO0va4tREqPd
BbIQcHKsFusBzi3Qz5aLBJa3dhzSJX7zDSrqbIicgclI2mMsxqUM1tLOdmsN8GLQ
KSQhk5KDO4nI9bUdVerypA41Q30yVQ7vlRhsumEIlZFRCDitPLRRwhY9dbB1l4mu
ba/+SDHOjx/tB+mDXHgSl8WxuBoH9vos6drGhSP59Hn29V0/hahrQnd0nmeCNFE5
xfzJeJsar39cegvGBtdRp4hOtUqK9cpwp6/zcvuzsnoLQjnDBtBBtO+iqI9IKoGg
fI+n+gGTP3Vwk9DwTszAyxEw2qKfW2gAlnWzzkqI7Hv0V1wgGgx1aNiEaEJjMc75
ldiE/dTJY1p5RZ1uYdvWLrV3WYID3qD7sl3O4z8PZy9pCKjHgfYrHPdaIQhAJ/QS
anr4t5uexxaB7uleQb+Uc5WxUEUFzUB1ne6DJoTHhQCoU6RodmvKDsAXvRcWrfIh
VZiV7I9+BGU=
=86Gf
-----END PGP SIGNATURE-----
–
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Related news

Ubuntu Security Notice USN-6730-1

Ubuntu Security Notice 6730-1 - It was discovered that Apache Maven Shared Utils did not handle double-quoted strings properly, allowing shell injection attacks. This could allow an attacker to run arbitrary code.

Red Hat Security Advisory 2024-0778-03

Red Hat Security Advisory 2024-0778-03 - An update for Jenkins and Jenkins-2-plugins is now available for OpenShift Developer Tools and Services for OCP 4.12. Issues addressed include bypass, code execution, cross site request forgery, cross site scripting, denial of service, improper authorization, information leakage, insecure permissions, and open redirection vulnerabilities.

Red Hat Security Advisory 2024-0777-03

Red Hat Security Advisory 2024-0777-03 - An update for jenkins and jenkins-2-plugins is now available for OpenShift Developer Tools and Services for OCP 4.14. Issues addressed include bypass, code execution, cross site request forgery, cross site scripting, denial of service, information leakage, and open redirection vulnerabilities.

Red Hat Security Advisory 2023-7288-01

Red Hat Security Advisory 2023-7288-01 - An update for Openshift Jenkins is now available for Red Hat Product OCP Tools 4.14. Issues addressed include bypass, code execution, cross site scripting, and denial of service vulnerabilities.

Red Hat Security Advisory 2023-3610-01

Red Hat Security Advisory 2023-3610-01 - Jenkins is a continuous integration server that monitors executions of repeated jobs, such as building a software project or jobs run by cron. Issues addressed include bypass, code execution, cross site request forgery, cross site scripting, denial of service, memory exhaustion, and resource exhaustion vulnerabilities.

RHSA-2023:3622: Red Hat Security Advisory: jenkins and jenkins-2-plugins security update

An update for jenkins and jenkins-2-plugins is now available for OpenShift Developer Tools and Services for OCP 4.13. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-29599: A flaw was found in the maven-shared-utils package. This issue allows a Command Injection due to improper escaping, allowing a shell injection attack. * CVE-2022-30953: A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.25.3 and earlier allows attackers to connect to an...

RHSA-2023:3610: Red Hat Security Advisory: jenkins and jenkins-2-plugins security update

An update for jenkins and jenkins-2-plugins is now available for OpenShift Developer Tools and Services for OCP 4.12. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-46877: A flaw was found in Jackson Databind. This issue may allow a malicious user to cause a denial of service (2 GB transient heap usage per read) in uncommon situations involving JsonNode JDK serialization. * CVE-2022-29599: A flaw was found in the maven-shared-utils package. This issue allows a Command...

Red Hat Security Advisory 2023-3198-01

Red Hat Security Advisory 2023-3198-01 - Jenkins is a continuous integration server that monitors executions of repeated jobs, such as building a software project or jobs run by cron. Issues addressed include bypass, code execution, cross site request forgery, cross site scripting, denial of service, deserialization, information leakage, and insecure permissions vulnerabilities.

RHSA-2023:3198: Red Hat Security Advisory: jenkins and jenkins-2-plugins security update

An update for jenkins and jenkins-2-plugins is now available for OpenShift Developer Tools and Services for OCP 4.11. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-26291: A flaw was found in maven. Repositories that are defined in a dependency’s Project Object Model (pom), which may be unknown to users, are used by default resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that r...

CVE-2023-21954: Oracle Critical Patch Update Advisory - April 2023

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through...

Red Hat Security Advisory 2023-0573-01

Red Hat Security Advisory 2023-0573-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.9.55. Issues addressed include a code execution vulnerability.

RHSA-2023:0573: Red Hat Security Advisory: OpenShift Container Platform 4.9.55 security update

Red Hat OpenShift Container Platform release 4.9.55 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-29599: A flaw was found in the maven-shared-utils package. This issue allows a Command Injection due to improper escaping, allowing a shell injection attack.

Red Hat Security Advisory 2022-9098-01

Red Hat Security Advisory 2022-9098-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.10.46. Issues addressed include a code execution vulnerability.

RHSA-2022:9098: Red Hat Security Advisory: OpenShift Container Platform 4.10.46 packages and security update

Red Hat OpenShift Container Platform release 4.10.46 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-29599: maven-shared-utils: Command injection via Commandline class

Red Hat Security Advisory 2022-2281-01

Red Hat Security Advisory 2022-2281-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 3.11.705.

Red Hat Security Advisory 2022-4798-01

Red Hat Security Advisory 2022-4798-01 - The Apache Maven Shared Utils project aims to be an improved functional replacement for plexus-utils in Maven. Issues addressed include a code execution vulnerability.

RHSA-2022:2281: Red Hat Security Advisory: OpenShift Container Platform 3.11.705 security update

Red Hat OpenShift Container Platform release 3.11.705 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 3.11. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-1677: openshift/router: route hijacking attack via crafted HAProxy configuration file

RHSA-2022:4798: Red Hat Security Advisory: maven:3.5 security update

An update for the maven:3.5 module is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.2 Extended Update Support, and Red Hat Enterprise Linux 8.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-29599: maven-shared-utils: Command injection via Commandline class

RHSA-2022:4797: Red Hat Security Advisory: maven:3.6 security update

An update for the maven:3.6 module is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.2 Extended Update Support, and Red Hat Enterprise Linux 8.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-29599: maven-shared-utils: Command injection via Commandline class

Red Hat Security Advisory 2022-4699-01

Red Hat Security Advisory 2022-4699-01 - The Apache Maven Shared Utils project aims to be an improved functional replacement for plexus-utils in Maven. Issues addressed include a code execution vulnerability.

RHSA-2022:4699: Red Hat Security Advisory: maven:3.5 security update

An update for the maven:3.5 module is now available for Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-29599: maven-shared-utils: Command injection via Commandline class

CVE-2022-29599: [MSHARED-297] Unconditionally single quote executable and arguments by roxspring · Pull Request #40 · apache/maven-shared-utils

In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks.

Packet Storm: Latest News

Acronis Cyber Protect/Backup Remote Code Execution
Packet Storm