{
  "@id": "urn:uuid:0c15dbe8-6aee-4b4b-9fd8-1390120fca74",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 5,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:11:56.518932+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.codehaus.plexus/plexus-utils@3.0.24-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.codehaus.plexus/plexus-utils@3.0.24-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:11:56.518932+00:00",
      "status_notes": "Vulnerability CVE-2017-1000487 does not affect version 3.0.24-tuxcare.1 of org.codehaus.plexus:plexus-utils. CVE-2017-1000487 affects Plexus-utils before version 3.0.16. The target is version 3.0.24, which contains the upstream fix commit b38a1b3a from October 2013. The vulnerable pattern (shell-based command execution allowing injection via shell metacharacters) has been removed by the upstream vendor fix that shipped in the 3.0.24 release. The fix eliminates shell interpretation by using direct process execution instead of shell-based execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.16), NVD (< 3.0.16), Snyk (< 3.0.16).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-1000487"
      },
      "impact_statement": "CVE-2017-1000487 affects Plexus-utils before version 3.0.16. The target is version 3.0.24, which contains the upstream fix commit b38a1b3a from October 2013. The vulnerable pattern (shell-based command execution allowing injection via shell metacharacters) has been removed by the upstream vendor fix that shipped in the 3.0.24 release. The fix eliminates shell interpretation by using direct process execution instead of shell-based execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.16), NVD (< 3.0.16), Snyk (< 3.0.16)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.codehaus.plexus/plexus-utils@3.0.24-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.codehaus.plexus/plexus-utils@3.0.24-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:02:01.158878+00:00",
      "status_notes": "Vulnerability CVE-2022-4244 does not affect version 3.0.24-tuxcare.1 of org.codehaus.plexus:plexus-utils. CVE-2022-4244 path traversal vulnerability is not present in plexus-utils 3.0.24. The upstream fix (commit 33a2853 by Christian Schulte, dated 2016-05-08) was already included in the upstream release that TuxCare onboarded. This fix added validation to prevent directory traversal during archive extraction. Later, TuxCare enhanced this protection with commit 77f759c9 (CVE-2025-67030 backport, 2026-08-05), which replaced the original absolute path check with a more robust canonical path validation. Both defenses block the same attack vector: malicious archive entry names containing path traversal sequences like \"../\" that attempt to write files outside the intended extraction directory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.24), NVD (< 3.0.24), Snyk (< 3.0.24).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-4244"
      },
      "impact_statement": "CVE-2022-4244 path traversal vulnerability is not present in plexus-utils 3.0.24. The upstream fix (commit 33a2853 by Christian Schulte, dated 2016-05-08) was already included in the upstream release that TuxCare onboarded. This fix added validation to prevent directory traversal during archive extraction. Later, TuxCare enhanced this protection with commit 77f759c9 (CVE-2025-67030 backport, 2026-08-05), which replaced the original absolute path check with a more robust canonical path validation. Both defenses block the same attack vector: malicious archive entry names containing path traversal sequences like \"../\" that attempt to write files outside the intended extraction directory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.24), NVD (< 3.0.24), Snyk (< 3.0.24)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.codehaus.plexus/plexus-utils@3.0.24-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.codehaus.plexus/plexus-utils@3.0.24-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T03:34:00.109441+00:00",
      "status_notes": "Vulnerability CVE-2022-4245 does not affect version 3.0.24-tuxcare.1 of org.codehaus.plexus:plexus-utils. not_affected \u2014 CVE-2022-4245 (XML injection via unsanitized comment delimiters) is NOT present in plexus-utils 3.0.24. The upstream fix (commit f933e5e by Christian Schulte) was already included when upstream version 3.0.24 was released on 2016-05-08. The target code at src/main/java/org/codehaus/plexus/util/xml/XmlWriterUtil.java lines 189-197 contains the sanitization logic that removes `<!--` and `-->` seq...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-4245"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-4245 (XML injection via unsanitized comment delimiters) is NOT present in plexus-utils 3.0.24. The upstream fix (commit f933e5e by Christian Schulte) was already included when upstream version 3.0.24 was released on 2016-05-08. The target code at src/main/java/org/codehaus/plexus/util/xml/XmlWriterUtil.java lines 189-197 contains the sanitization logic that removes `<!--` and `-->` seq..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.codehaus.plexus/plexus-utils@3.0.24-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.codehaus.plexus/plexus-utils@3.0.24-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-67030 is fixed in version 3.0.24-tuxcare.1 of org.codehaus.plexus:plexus-utils.",
      "vulnerability": {
        "name": "CVE-2025-67030"
      }
    }
  ]
}