Stay Secure with the Latest Linux Advisories

security advisoryRed Hatsecurity impact

RedHat: RHSA-2022-4797-01 Important: Command Injection in Maven 3.6

An update for the maven:3.6 module is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.2 Extended Update Support, and Red Hat Enterprise Linux 8.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: maven:3.6 security update Advisory ID: RHSA-2022:4797-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2022:4797 Issue date: 2022-05-30 CVE Names: CVE-2022-29599 ==================================================================== 1. Summary: An update for the maven:3.6 module is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.2 Extended Update Support, and Red Hat Enterprise Linux 8.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AppStream (v. 8) - noarch Red Hat Enterprise Linux AppStream EUS (v. 8.2) - noarch Red Hat Enterprise Linux AppStream EUS (v.8.4) - noarch 3. Description: The Apache Maven Shared Utils project aims to be an improved functional replacement for plexus-utils in Maven. Security Fix(es): * maven-shared-utils: Command injection via Commandline class (CVE-2022-29599) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugsfixed (https://bugzilla.redhat.com/): 2066479 - CVE-2022-29599 maven-shared-utils: Command injection via Commandline class 6. Package List: Red Hat Enterprise Linux AppStream EUS (v.8.2): Source: aopalliance-1.0-20.module+el8.2.0+5557+11a14461.src.rpm apache-commons-cli-1.4-7.module+el8.2.0+5557+11a14461.src.rpm apache-commons-codec-1.13-3.module+el8.2.0+5557+11a14461.src.rpm apache-commons-io-2.6-6.module+el8.2.0+5557+11a14461.src.rpm apache-commons-lang3-3.9-4.module+el8.2.0+5557+11a14461.src.rpm atinject-1-31.20100611svn86.module+el8.2.0+5557+11a14461.src.rpm cdi-api-2.0.1-3.module+el8.2.0+5557+11a14461.src.rpm geronimo-annotation-1.0-26.module+el8.2.0+5557+11a14461.src.rpm google-guice-4.2.2-4.module+el8.2.0+5557+11a14461.src.rpm guava-28.1-3.module+el8.2.0+5557+11a14461.src.rpm httpcomponents-client-4.5.10-3.module+el8.2.0+5557+11a14461.src.rpm httpcomponents-core-4.4.12-3.module+el8.2.0+5557+11a14461.src.rpm jansi-1.18-4.module+el8.2.0+5557+11a14461.src.rpm jsoup-1.12.1-3.module+el8.2.0+5557+11a14461.src.rpm jsr-305-0-0.25.20130910svn.module+el8.2.0+5557+11a14461.src.rpm maven-3.6.2-4.module+el8.2.0+5560+b953ed0b.src.rpm maven-resolver-1.4.1-3.module+el8.2.0+5557+11a14461.src.rpm maven-shared-utils-3.2.1-0.5.module+el8.2.0+15047+acf0c170.src.rpm maven-wagon-3.3.4-2.module+el8.2.0+5557+11a14461.src.rpm plexus-cipher-1.7-17.module+el8.2.0+5557+11a14461.src.rpm plexus-classworlds-2.6.0-4.module+el8.2.0+5557+11a14461.src.rpm plexus-containers-2.1.0-2.module+el8.2.0+5557+11a14461.src.rpm plexus-interpolation-1.26-3.module+el8.2.0+5557+11a14461.src.rpm plexus-sec-dispatcher-1.4-29.module+el8.2.0+5557+11a14461.src.rpm plexus-utils-3.3.0-3.module+el8.2.0+5557+11a14461.src.rpm sisu-0.3.4-2.module+el8.2.0+5557+11a14461.src.rpm slf4j-1.7.28-3.module+el8.2.0+5557+11a14461.src.rpm noarch: aopalliance-1.0-20.module+el8.2.0+5557+11a14461.noarch.rpm apache-commons-cli-1.4-7.module+el8.2.0+5557+11a14461.noarch.rpm apache-commons-codec-1.13-3.module+el8.2.0+5557+11a14461.noarch.rpm apache-commons-io-2.6-6.module+el8.2.0+5557+11a14461.noarch.rpm apache-commons-lang3-3.9-4.module+el8.2.0+5557+11a14461.noarch.rpm atinject-1-31.20100611svn86.module+el8.2.0+5557+11a14461.noarch.rpm cdi-api-2.0.1-3.module+el8.2.0+5557+11a14461.noarch.rpm geronimo-annotation-1.0-26.module+el8.2.0+5557+11a14461.noarch.rpm google-guice-4.2.2-4.module+el8.2.0+5557+11a14461.noarch.rpm guava-28.1-3.module+el8.2.0+5557+11a14461.noarch.rpm httpcomponents-client-4.5.10-3.module+el8.2.0+5557+11a14461.noarch.rpm httpcomponents-core-4.4.12-3.module+el8.2.0+5557+11a14461.noarch.rpm jansi-1.18-4.module+el8.2.0+5557+11a14461.noarch.rpm jcl-over-slf4j-1.7.28-3.module+el8.2.0+5557+11a14461.noarch.rpm jsoup-1.12.1-3.module+el8.2.0+5557+11a14461.noarch.rpm jsr-305-0-0.25.20130910svn.module+el8.2.0+5557+11a14461.noarch.rpm maven-3.6.2-4.module+el8.2.0+5560+b953ed0b.noarch.rpm maven-lib-3.6.2-4.module+el8.2.0+5560+b953ed0b.noarch.rpm maven-openjdk11-3.6.2-4.module+el8.2.0+5560+b953ed0b.noarch.rpm maven-openjdk8-3.6.2-4.module+el8.2.0+5560+b953ed0b.noarch.rpm maven-resolver-1.4.1-3.module+el8.2.0+5557+11a14461.noarch.rpm maven-shared-utils-3.2.1-0.5.module+el8.2.0+15047+acf0c170.noarch.rpm maven-wagon-3.3.4-2.module+el8.2.0+5557+11a14461.noarch.rpm plexus-cipher-1.7-17.module+el8.2.0+5557+11a14461.noarch.rpm plexus-classworlds-2.6.0-4.module+el8.2.0+5557+11a14461.noarch.rpm plexus-containers-component-annotations-2.1.0-2.module+el8.2.0+5557+11a14461.noarch.rpm plexus-interpolation-1.26-3.module+el8.2.0+5557+11a14461.noarch.rpm plexus-sec-dispatcher-1.4-29.module+el8.2.0+5557+11a14461.noarch.rpm plexus-utils-3.3.0-3.module+el8.2.0+5557+11a14461.noarch.rpm sisu-0.3.4-2.module+el8.2.0+5557+11a14461.noarch.rpm slf4j-1.7.28-3.module+el8.2.0+5557+11a14461.noarch.rpm Red Hat Enterprise Linux AppStream EUS(v.8.4): Source: aopalliance-1.0-20.module+el8.3.0+6804+157bd82e.src.rpm apache-commons-cli-1.4-7.module+el8.3.0+6804+157bd82e.src.rpm apache-commons-codec-1.13-3.module+el8.3.0+6804+157bd82e.src.rpm apache-commons-io-2.6-6.module+el8.3.0+6804+157bd82e.src.rpm apache-commons-lang3-3.9-4.module+el8.3.0+6804+157bd82e.src.rpm atinject-1-31.20100611svn86.module+el8.3.0+6804+157bd82e.src.rpm cdi-api-2.0.1-3.module+el8.3.0+6804+157bd82e.src.rpm geronimo-annotation-1.0-26.module+el8.3.0+6804+157bd82e.src.rpm google-guice-4.2.2-4.module+el8.3.0+6804+157bd82e.src.rpm guava-28.1-3.module+el8.3.0+6804+157bd82e.src.rpm httpcomponents-client-4.5.10-3.module+el8.3.0+6804+157bd82e.src.rpm httpcomponents-core-4.4.12-3.module+el8.3.0+6804+157bd82e.src.rpm jansi-1.18-4.module+el8.3.0+6804+157bd82e.src.rpm jsoup-1.12.1-3.module+el8.3.0+6804+157bd82e.src.rpm jsr-305-0-0.25.20130910svn.module+el8.3.0+6804+157bd82e.src.rpm maven-3.6.2-6.module+el8.4.0+9250+1786af37.src.rpm maven-resolver-1.4.1-3.module+el8.3.0+6804+157bd82e.src.rpm maven-shared-utils-3.2.1-0.5.module+el8.4.0+15048+bdaf849b.src.rpm maven-wagon-3.3.4-2.module+el8.3.0+6804+157bd82e.src.rpm plexus-cipher-1.7-17.module+el8.3.0+6804+157bd82e.src.rpm plexus-classworlds-2.6.0-4.module+el8.3.0+6804+157bd82e.src.rpm plexus-containers-2.1.0-2.module+el8.3.0+6804+157bd82e.src.rpm plexus-interpolation-1.26-3.module+el8.3.0+6804+157bd82e.src.rpm plexus-sec-dispatcher-1.4-29.module+el8.3.0+6804+157bd82e.src.rpm plexus-utils-3.3.0-3.module+el8.3.0+6804+157bd82e.src.rpm sisu-0.3.4-2.module+el8.3.0+6804+157bd82e.src.rpm slf4j-1.7.28-3.module+el8.3.0+6804+157bd82e.src.rpm noarch: aopalliance-1.0-20.module+el8.3.0+6804+157bd82e.noarch.rpm apache-commons-cli-1.4-7.module+el8.3.0+6804+157bd82e.noarch.rpm apache-commons-codec-1.13-3.module+el8.3.0+6804+157bd82e.noarch.rpm apache-commons-io-2.6-6.module+el8.3.0+6804+157bd82e.noarch.rpm apache-commons-lang3-3.9-4.module+el8.3.0+6804+157bd82e.noarch.rpm atinject-1-31.20100611svn86.module+el8.3.0+6804+157bd82e.noarch.rpm cdi-api-2.0.1-3.module+el8.3.0+6804+157bd82e.noarch.rpm geronimo-annotation-1.0-26.module+el8.3.0+6804+157bd82e.noarch.rpm google-guice-4.2.2-4.module+el8.3.0+6804+157bd82e.noarch.rpm guava-28.1-3.module+el8.3.0+6804+157bd82e.noarch.rpm httpcomponents-client-4.5.10-3.module+el8.3.0+6804+157bd82e.noarch.rpm httpcomponents-core-4.4.12-3.module+el8.3.0+6804+157bd82e.noarch.rpm jansi-1.18-4.module+el8.3.0+6804+157bd82e.noarch.rpm jcl-over-slf4j-1.7.28-3.module+el8.3.0+6804+157bd82e.noarch.rpm jsoup-1.12.1-3.module+el8.3.0+6804+157bd82e.noarch.rpm jsr-305-0-0.25.20130910svn.module+el8.3.0+6804+157bd82e.noarch.rpm maven-3.6.2-6.module+el8.4.0+9250+1786af37.noarch.rpm maven-lib-3.6.2-6.module+el8.4.0+9250+1786af37.noarch.rpm maven-openjdk11-3.6.2-6.module+el8.4.0+9250+1786af37.noarch.rpm maven-openjdk8-3.6.2-6.module+el8.4.0+9250+1786af37.noarch.rpm maven-resolver-1.4.1-3.module+el8.3.0+6804+157bd82e.noarch.rpm maven-shared-utils-3.2.1-0.5.module+el8.4.0+15048+bdaf849b.noarch.rpm maven-wagon-3.3.4-2.module+el8.3.0+6804+157bd82e.noarch.rpm plexus-cipher-1.7-17.module+el8.3.0+6804+157bd82e.noarch.rpm plexus-classworlds-2.6.0-4.module+el8.3.0+6804+157bd82e.noarch.rpm plexus-containers-component-annotations-2.1.0-2.module+el8.3.0+6804+157bd82e.noarch.rpm plexus-interpolation-1.26-3.module+el8.3.0+6804+157bd82e.noarch.rpm plexus-sec-dispatcher-1.4-29.module+el8.3.0+6804+157bd82e.noarch.rpm plexus-utils-3.3.0-3.module+el8.3.0+6804+157bd82e.noarch.rpm sisu-0.3.4-2.module+el8.3.0+6804+157bd82e.noarch.rpm slf4j-1.7.28-3.module+el8.3.0+6804+157bd82e.noarch.rpm Red Hat Enterprise Linux AppStream (v.8): Source: aopalliance-1.0-20.module+el8.6.0+13337+afcb49ec.src.rpm apache-commons-cli-1.4-7.module+el8.6.0+13337+afcb49ec.src.rpm apache-commons-codec-1.13-3.module+el8.6.0+13337+afcb49ec.src.rpm apache-commons-io-2.6-6.module+el8.6.0+13337+afcb49ec.src.rpm apache-commons-lang3-3.9-4.module+el8.6.0+13337+afcb49ec.src.rpm atinject-1-31.20100611svn86.module+el8.6.0+13337+afcb49ec.src.rpm cdi-api-2.0.1-3.module+el8.6.0+13337+afcb49ec.src.rpm geronimo-annotation-1.0-26.module+el8.6.0+13337+afcb49ec.src.rpm google-guice-4.2.2-4.module+el8.6.0+13337+afcb49ec.src.rpm guava-28.1-3.module+el8.6.0+13337+afcb49ec.src.rpm httpcomponents-client-4.5.10-4.module+el8.6.0+13337+afcb49ec.src.rpm httpcomponents-core-4.4.12-3.module+el8.6.0+13337+afcb49ec.src.rpm jansi-1.18-4.module+el8.6.0+13337+afcb49ec.src.rpm jsoup-1.12.1-3.module+el8.6.0+13337+afcb49ec.src.rpm jsr-305-0-0.25.20130910svn.module+el8.6.0+13337+afcb49ec.src.rpm maven-3.6.2-7.module+el8.6.0+13337+afcb49ec.src.rpm maven-resolver-1.4.1-3.module+el8.6.0+13337+afcb49ec.src.rpm maven-shared-utils-3.2.1-0.5.module+el8.6.0+15049+43453910.src.rpm maven-wagon-3.3.4-2.module+el8.6.0+13337+afcb49ec.src.rpm plexus-cipher-1.7-17.module+el8.6.0+13337+afcb49ec.src.rpm plexus-classworlds-2.6.0-4.module+el8.6.0+13337+afcb49ec.src.rpm plexus-containers-2.1.0-2.module+el8.6.0+13337+afcb49ec.src.rpm plexus-interpolation-1.26-3.module+el8.6.0+13337+afcb49ec.src.rpm plexus-sec-dispatcher-1.4-29.module+el8.6.0+13337+afcb49ec.src.rpm plexus-utils-3.3.0-3.module+el8.6.0+13337+afcb49ec.src.rpm sisu-0.3.4-2.module+el8.6.0+13337+afcb49ec.src.rpm slf4j-1.7.28-3.module+el8.6.0+13337+afcb49ec.src.rpm noarch: aopalliance-1.0-20.module+el8.6.0+13337+afcb49ec.noarch.rpm apache-commons-cli-1.4-7.module+el8.6.0+13337+afcb49ec.noarch.rpm apache-commons-codec-1.13-3.module+el8.6.0+13337+afcb49ec.noarch.rpm apache-commons-io-2.6-6.module+el8.6.0+13337+afcb49ec.noarch.rpm apache-commons-lang3-3.9-4.module+el8.6.0+13337+afcb49ec.noarch.rpm atinject-1-31.20100611svn86.module+el8.6.0+13337+afcb49ec.noarch.rpm cdi-api-2.0.1-3.module+el8.6.0+13337+afcb49ec.noarch.rpm geronimo-annotation-1.0-26.module+el8.6.0+13337+afcb49ec.noarch.rpm google-guice-4.2.2-4.module+el8.6.0+13337+afcb49ec.noarch.rpm guava-28.1-3.module+el8.6.0+13337+afcb49ec.noarch.rpm httpcomponents-client-4.5.10-4.module+el8.6.0+13337+afcb49ec.noarch.rpm httpcomponents-core-4.4.12-3.module+el8.6.0+13337+afcb49ec.noarch.rpm jansi-1.18-4.module+el8.6.0+13337+afcb49ec.noarch.rpm jcl-over-slf4j-1.7.28-3.module+el8.6.0+13337+afcb49ec.noarch.rpm jsoup-1.12.1-3.module+el8.6.0+13337+afcb49ec.noarch.rpm jsr-305-0-0.25.20130910svn.module+el8.6.0+13337+afcb49ec.noarch.rpm maven-3.6.2-7.module+el8.6.0+13337+afcb49ec.noarch.rpm maven-lib-3.6.2-7.module+el8.6.0+13337+afcb49ec.noarch.rpm maven-openjdk11-3.6.2-7.module+el8.6.0+13337+afcb49ec.noarch.rpm maven-openjdk17-3.6.2-7.module+el8.6.0+13337+afcb49ec.noarch.rpm maven-openjdk8-3.6.2-7.module+el8.6.0+13337+afcb49ec.noarch.rpm maven-resolver-1.4.1-3.module+el8.6.0+13337+afcb49ec.noarch.rpm maven-shared-utils-3.2.1-0.5.module+el8.6.0+15049+43453910.noarch.rpm maven-wagon-3.3.4-2.module+el8.6.0+13337+afcb49ec.noarch.rpm plexus-cipher-1.7-17.module+el8.6.0+13337+afcb49ec.noarch.rpm plexus-classworlds-2.6.0-4.module+el8.6.0+13337+afcb49ec.noarch.rpm plexus-containers-component-annotations-2.1.0-2.module+el8.6.0+13337+afcb49ec.noarch.rpm plexus-interpolation-1.26-3.module+el8.6.0+13337+afcb49ec.noarch.rpm plexus-sec-dispatcher-1.4-29.module+el8.6.0+13337+afcb49ec.noarch.rpm plexus-utils-3.3.0-3.module+el8.6.0+13337+afcb49ec.noarch.rpm sisu-0.3.4-2.module+el8.6.0+13337+afcb49ec.noarch.rpm slf4j-1.7.28-3.module+el8.6.0+13337+afcb49ec.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7. References: https://access.redhat.com/security/cve/CVE-2022-29599 https://access.redhat.com/security/updates/classification#important 8. Contact: The Red Hat security contact is . More contact details athttps://access.redhat.com/security/team/contact Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYpTSBNzjgjWX9erEAQiJ1xAAkYmSMa4bJ5b6iRezcg6+upucDSznAYBj XKcomZR/XXwJ+nnDhzn8qiF20KNIBObUkmSiSpBuTCMAf4EH2qXgQAh+WM3Endfo ISUulqNPMwuexVCOOdp1QEjfXNGocxXKRF83FPSQjqNTh3pFmvRjFWGnMHOHs1UP OMOT/urpxB/2dKFUzA2fxhdj2kIumTON71Ixt55rmOpX+1/DMMoSDO0va4tREqPd BbIQcHKsFusBzi3Qz5aLBJa3dhzSJX7zDSrqbIicgclI2mMsxqUM1tLOdmsN8GLQ KSQhk5KDO4nI9bUdVerypA41Q30yVQ7vlRhsumEIlZFRCDitPLRRwhY9dbB1l4mu ba/+SDHOjx/tB+mDXHgSl8WxuBoH9vos6drGhSP59Hn29V0/hahrQnd0nmeCNFE5 xfzJeJsar39cegvGBtdRp4hOtUqK9cpwp6/zcvuzsnoLQjnDBtBBtO+iqI9IKoGg fI+n+gGTP3Vwk9DwTszAyxEw2qKfW2gAlnWzzkqI7Hv0V1wgGgx1aNiEaEJjMc75 ldiE/dTJY1p5RZ1uYdvWLrV3WYID3qD7sl3O4z8PZy9pCKjHgfYrHPdaIQhAJ/QS anr4t5uexxaB7uleQb+Uc5WxUEUFzUB1ne6DJoTHhQCoU6RodmvKDsAXvRcWrfIh VZiV7I9+BGU=86Gf -----END PGP SIGNATURE----- -- RHSA-announce mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. . Canonical issues a critical security patch for git:2.30, mitigating buffer overflow risks in Ubuntu Server.. Red Hat Security Update,maven module update,command injection vulnerability,enterprise linux security. . Severity: Important. LinuxSecurity.com Team

May 30, 2022 •Important Red Hat