{
  "@id": "urn:uuid:9a17d936-0de4-4736-902f-3bdfd5aa0ba7",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 5,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:12:40.044104+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.codehaus.plexus/plexus-utils@3.1.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.codehaus.plexus/plexus-utils@3.1.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:12:40.044104+00:00",
      "status_notes": "Vulnerability CVE-2017-1000487 does not affect version 3.1.1-tuxcare.1 of org.codehaus.plexus:plexus-utils. Target plexus-utils 3.1.1 is not affected by CVE-2017-1000487 (command injection via inadequate shell metacharacter escaping). The upstream vendor fix (commit b38a1b3a4352303e4312b2bb601a0d7ec6e28f41 by krosenvold@apache.org, October 2013) was already present in the upstream release before TuxCare onboarding. The fix changes execution from shell-interpreted (getShellCommandline) to direct execution (getCommandline) and implements proper single-quote escaping for cases requiring shell command generation. All defensive code changes are present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.16), NVD (< 3.0.16), Snyk (< 3.0.16).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-1000487"
      },
      "impact_statement": "Target plexus-utils 3.1.1 is not affected by CVE-2017-1000487 (command injection via inadequate shell metacharacter escaping). The upstream vendor fix (commit b38a1b3a4352303e4312b2bb601a0d7ec6e28f41 by krosenvold@apache.org, October 2013) was already present in the upstream release before TuxCare onboarding. The fix changes execution from shell-interpreted (getShellCommandline) to direct execution (getCommandline) and implements proper single-quote escaping for cases requiring shell command generation. All defensive code changes are present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.16), NVD (< 3.0.16), Snyk (< 3.0.16)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.codehaus.plexus/plexus-utils@3.1.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.codehaus.plexus/plexus-utils@3.1.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:04:03.421384+00:00",
      "status_notes": "Vulnerability CVE-2022-4244 does not affect version 3.1.1-tuxcare.1 of org.codehaus.plexus:plexus-utils. CVE-2022-4244 is not present in plexus-utils 3.1.1-tuxcare.1. The directory traversal vulnerability was already fixed in the upstream release 3.1.1 (commit 33a2853 from May 2016) before TuxCare onboarded it. The current code contains an even stronger defense against path traversal (using getCanonicalPath() instead of getAbsolutePath()) that was added later as part of CVE-2025-67030 backport, but the original CVE-2022-4244 fix was already present in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.24), NVD (< 3.0.24), Snyk (< 3.0.24).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-4244"
      },
      "impact_statement": "CVE-2022-4244 is not present in plexus-utils 3.1.1-tuxcare.1. The directory traversal vulnerability was already fixed in the upstream release 3.1.1 (commit 33a2853 from May 2016) before TuxCare onboarded it. The current code contains an even stronger defense against path traversal (using getCanonicalPath() instead of getAbsolutePath()) that was added later as part of CVE-2025-67030 backport, but the original CVE-2022-4244 fix was already present in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.24), NVD (< 3.0.24), Snyk (< 3.0.24)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.codehaus.plexus/plexus-utils@3.1.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.codehaus.plexus/plexus-utils@3.1.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T03:36:19.499435+00:00",
      "status_notes": "Vulnerability CVE-2022-4245 does not affect version 3.1.1-tuxcare.1 of org.codehaus.plexus:plexus-utils. not_affected \u2014 CVE-2022-4245 is not present in plexus-utils 3.1.1-tuxcare.1. The vulnerable pattern (unsanitized XML comment writing allowing injection via `-->` sequence) was fixed by upstream commit f933e5e (Christian Schulte, 2016-05-08) which shipped in the upstream 3.1.1 release. The fix sanitizes comment text by removing `<!--` and `-->` sequences before writing (lines 191-199 of XmlWriterUtil.java). Al...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-4245"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-4245 is not present in plexus-utils 3.1.1-tuxcare.1. The vulnerable pattern (unsanitized XML comment writing allowing injection via `-->` sequence) was fixed by upstream commit f933e5e (Christian Schulte, 2016-05-08) which shipped in the upstream 3.1.1 release. The fix sanitizes comment text by removing `<!--` and `-->` sequences before writing (lines 191-199 of XmlWriterUtil.java). Al..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.codehaus.plexus/plexus-utils@3.1.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.codehaus.plexus/plexus-utils@3.1.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T21:42:29.909242+00:00",
      "status_notes": "Vulnerability CVE-2025-67030 is fixed in version 3.1.1-tuxcare.1 of org.codehaus.plexus:plexus-utils.",
      "vulnerability": {
        "name": "CVE-2025-67030"
      }
    }
  ]
}