{
  "@id": "urn:uuid:a27a981a-0570-4728-a860-303ccaad84ba",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 5,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:12:40.044104+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.codehaus.plexus/plexus-utils@3.2.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.codehaus.plexus/plexus-utils@3.2.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:12:40.044104+00:00",
      "status_notes": "Vulnerability CVE-2017-1000487 does not affect version 3.2.0-tuxcare.1 of org.codehaus.plexus:plexus-utils. Target version 3.2.0 is not affected by CVE-2017-1000487. The vulnerability was fixed in upstream commit b38a1b3 (2013-10-23) by Kristian Rosenvold, which replaced double-quote-based shell quoting (vulnerable to command injection via shell metacharacters) with single-quote-based quoting and direct process execution. This fix was already present in the upstream 3.2.0 release that TuxCare onboarded. The CVE states \"Plexus-utils before 3.0.16 is vulnerable\" and version 3.2.0 > 3.0.16.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.16), NVD (< 3.0.16), Snyk (< 3.0.16).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-1000487"
      },
      "impact_statement": "Target version 3.2.0 is not affected by CVE-2017-1000487. The vulnerability was fixed in upstream commit b38a1b3 (2013-10-23) by Kristian Rosenvold, which replaced double-quote-based shell quoting (vulnerable to command injection via shell metacharacters) with single-quote-based quoting and direct process execution. This fix was already present in the upstream 3.2.0 release that TuxCare onboarded. The CVE states \"Plexus-utils before 3.0.16 is vulnerable\" and version 3.2.0 > 3.0.16.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.16), NVD (< 3.0.16), Snyk (< 3.0.16)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.codehaus.plexus/plexus-utils@3.2.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.codehaus.plexus/plexus-utils@3.2.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:02:52.397356+00:00",
      "status_notes": "Vulnerability CVE-2022-4244 does not affect version 3.2.0-tuxcare.1 of org.codehaus.plexus:plexus-utils. The target plexus-utils 3.2.0 is NOT affected by CVE-2022-4244. The upstream fix for this directory traversal vulnerability was already present in the 3.2.0 release that TuxCare onboarded. The original fix (commit 33a2853d by Christian Schulte) added path validation using getAbsolutePath() to prevent archive entries from extracting outside the target directory. TuxCare later improved this fix in commit 44832db (CVE-2025-67030) by using getCanonicalPath() for stronger protection, but the core CVE-2022-4244 vulnerability was already mitigated in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.24), NVD (< 3.0.24), Snyk (< 3.0.24).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-4244"
      },
      "impact_statement": "The target plexus-utils 3.2.0 is NOT affected by CVE-2022-4244. The upstream fix for this directory traversal vulnerability was already present in the 3.2.0 release that TuxCare onboarded. The original fix (commit 33a2853d by Christian Schulte) added path validation using getAbsolutePath() to prevent archive entries from extracting outside the target directory. TuxCare later improved this fix in commit 44832db (CVE-2025-67030) by using getCanonicalPath() for stronger protection, but the core CVE-2022-4244 vulnerability was already mitigated in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.24), NVD (< 3.0.24), Snyk (< 3.0.24)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.codehaus.plexus/plexus-utils@3.2.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.codehaus.plexus/plexus-utils@3.2.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T03:34:00.109441+00:00",
      "status_notes": "Vulnerability CVE-2022-4245 does not affect version 3.2.0-tuxcare.1 of org.codehaus.plexus:plexus-utils. not_affected \u2014 The target plexus-utils 3.2.0 is not affected by CVE-2022-4245. The vulnerability's fix (removal of XML comment delimiters from user input to prevent XML injection) was already present in the upstream 3.2.0 release before TuxCare onboarded the project. The fix commit (f933e5e) by Christian Schulte from May 2016 added sanitization that strips `<!--` and `-->` sequences from comment strings in Xm...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-4245"
      },
      "impact_statement": "not_affected \u2014 The target plexus-utils 3.2.0 is not affected by CVE-2022-4245. The vulnerability's fix (removal of XML comment delimiters from user input to prevent XML injection) was already present in the upstream 3.2.0 release before TuxCare onboarded the project. The fix commit (f933e5e) by Christian Schulte from May 2016 added sanitization that strips `<!--` and `-->` sequences from comment strings in Xm..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.codehaus.plexus/plexus-utils@3.2.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.codehaus.plexus/plexus-utils@3.2.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-67030 is fixed in version 3.2.0-tuxcare.1 of org.codehaus.plexus:plexus-utils.",
      "vulnerability": {
        "name": "CVE-2025-67030"
      }
    }
  ]
}