{
  "@id": "urn:uuid:8656a68e-c51c-47c5-a87d-a53f387905cd",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 5,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:10:20.881763+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.codehaus.plexus/plexus-utils@3.2.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.codehaus.plexus/plexus-utils@3.2.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:10:20.881763+00:00",
      "status_notes": "Vulnerability CVE-2017-1000487 does not affect version 3.2.1-tuxcare.1 of org.codehaus.plexus:plexus-utils. CVE-2017-1000487 affects plexus-utils before version 3.0.16 due to command injection via inadequate shell escaping in double-quoted strings. The target is version 3.2.1-tuxcare.1, which already contains the upstream fix (commit b38a1b3, Oct 2013) that prevents shell metacharacter interpretation through (1) unconditional single-quote escaping and (2) direct exec bypassing shell. The fix was shipped in the upstream release before TuxCare onboarded this version. The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.16), NVD (< 3.0.16), Snyk (< 3.0.16).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-1000487"
      },
      "impact_statement": "CVE-2017-1000487 affects plexus-utils before version 3.0.16 due to command injection via inadequate shell escaping in double-quoted strings. The target is version 3.2.1-tuxcare.1, which already contains the upstream fix (commit b38a1b3, Oct 2013) that prevents shell metacharacter interpretation through (1) unconditional single-quote escaping and (2) direct exec bypassing shell. The fix was shipped in the upstream release before TuxCare onboarded this version. The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.16), NVD (< 3.0.16), Snyk (< 3.0.16)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.codehaus.plexus/plexus-utils@3.2.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.codehaus.plexus/plexus-utils@3.2.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:01:20.989527+00:00",
      "status_notes": "Vulnerability CVE-2022-4244 does not affect version 3.2.1-tuxcare.1 of org.codehaus.plexus:plexus-utils. The target repository (plexus-utils 3.2.1) is NOT AFFECTED by CVE-2022-4244. The upstream fix for directory traversal (commit 33a2853 by Christian Schulte, May 2016) was already present in the upstream release that TuxCare onboarded. The current code contains an enhanced version of this fix (from CVE-2025-67030) that uses canonical path resolution with file separator checks, providing even stronger protection against directory traversal attacks during archive extraction.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.24), NVD (< 3.0.24), Snyk (< 3.0.24).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-4244"
      },
      "impact_statement": "The target repository (plexus-utils 3.2.1) is NOT AFFECTED by CVE-2022-4244. The upstream fix for directory traversal (commit 33a2853 by Christian Schulte, May 2016) was already present in the upstream release that TuxCare onboarded. The current code contains an enhanced version of this fix (from CVE-2025-67030) that uses canonical path resolution with file separator checks, providing even stronger protection against directory traversal attacks during archive extraction.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.24), NVD (< 3.0.24), Snyk (< 3.0.24)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.codehaus.plexus/plexus-utils@3.2.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.codehaus.plexus/plexus-utils@3.2.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T03:33:00.174696+00:00",
      "status_notes": "Vulnerability CVE-2022-4245 does not affect version 3.2.1-tuxcare.1 of org.codehaus.plexus:plexus-utils. not_affected \u2014 The target repository (plexus-utils 3.2.1-tuxcare.1 at SHA 26aaaeb) does not contain the CVE-2022-4245 vulnerability. The upstream fix that sanitizes XML comment injection by removing `<!--` and `-->` sequences was already present in the upstream 3.2.1 release before TuxCare onboarded it. The writeComment method in XmlWriterUtil.java (lines 191-199) contains the required sanitization loops that...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-4245"
      },
      "impact_statement": "not_affected \u2014 The target repository (plexus-utils 3.2.1-tuxcare.1 at SHA 26aaaeb) does not contain the CVE-2022-4245 vulnerability. The upstream fix that sanitizes XML comment injection by removing `<!--` and `-->` sequences was already present in the upstream 3.2.1 release before TuxCare onboarded it. The writeComment method in XmlWriterUtil.java (lines 191-199) contains the required sanitization loops that..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.codehaus.plexus/plexus-utils@3.2.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.codehaus.plexus/plexus-utils@3.2.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-67030 is fixed in version 3.2.1-tuxcare.1 of org.codehaus.plexus:plexus-utils.",
      "vulnerability": {
        "name": "CVE-2025-67030"
      }
    }
  ]
}