{
  "@id": "urn:uuid:a8574a42-7c27-4290-8295-108726c6d903",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 5,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:15:19.421943+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.codehaus.plexus/plexus-utils@3.4.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.codehaus.plexus/plexus-utils@3.4.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:15:19.421943+00:00",
      "status_notes": "Vulnerability CVE-2017-1000487 does not affect version 3.4.1-tuxcare.1 of org.codehaus.plexus:plexus-utils. The target plexus-utils version 3.4.1 is NOT affected by CVE-2017-1000487. The vulnerability (command injection via improper quoting in shell command execution) was fixed in upstream commit b38a1b3a4352303e4312b2bb601a0d7ec6e28f41 dated 2013-10-08, which is part of the upstream release 3.4.1 that TuxCare onboarded. The fix replaced conditional quoting logic with unconditional single-quoting using the shell-safe pattern that prevents metacharacter interpretation. All defensive code is present in the target: BourneShell.setUnconditionalQuoting(true), single-quote delimiters, quoteOneItem() with proper '\\\"'\\\"' escaping, and Commandline.execute() using getCommandline() instead of getShellCommandline().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.16), NVD (< 3.0.16), Snyk (< 3.0.16).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-1000487"
      },
      "impact_statement": "The target plexus-utils version 3.4.1 is NOT affected by CVE-2017-1000487. The vulnerability (command injection via improper quoting in shell command execution) was fixed in upstream commit b38a1b3a4352303e4312b2bb601a0d7ec6e28f41 dated 2013-10-08, which is part of the upstream release 3.4.1 that TuxCare onboarded. The fix replaced conditional quoting logic with unconditional single-quoting using the shell-safe pattern that prevents metacharacter interpretation. All defensive code is present in the target: BourneShell.setUnconditionalQuoting(true), single-quote delimiters, quoteOneItem() with proper '\\\"'\\\"' escaping, and Commandline.execute() using getCommandline() instead of getShellCommandline().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.16), NVD (< 3.0.16), Snyk (< 3.0.16)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.codehaus.plexus/plexus-utils@3.4.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.codehaus.plexus/plexus-utils@3.4.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:06:46.571739+00:00",
      "status_notes": "Vulnerability CVE-2022-4244 does not affect version 3.4.1-tuxcare.1 of org.codehaus.plexus:plexus-utils. CVE-2022-4244 is a directory traversal vulnerability in plexus-utils that allows attackers to extract ZIP entries outside the intended directory using path traversal sequences (../) or absolute paths. The vulnerability was fixed in upstream commit 33a2853 (May 2016) by Christian Schulte, which added a path validation check to reject entries resolving outside the target directory. This fix shipped in upstream release 3.4.1 that TuxCare onboarded. The target version 3.4.1 contains the fix and is not vulnerable. The current HEAD also includes an enhanced fix for CVE-2025-67030 (using canonical paths and File.separator checks) that provides even stronger protection, but the simple upstream fix was already sufficient for CVE-2022-4244.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.24), NVD (< 3.0.24), Snyk (< 3.0.24).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-4244"
      },
      "impact_statement": "CVE-2022-4244 is a directory traversal vulnerability in plexus-utils that allows attackers to extract ZIP entries outside the intended directory using path traversal sequences (../) or absolute paths. The vulnerability was fixed in upstream commit 33a2853 (May 2016) by Christian Schulte, which added a path validation check to reject entries resolving outside the target directory. This fix shipped in upstream release 3.4.1 that TuxCare onboarded. The target version 3.4.1 contains the fix and is not vulnerable. The current HEAD also includes an enhanced fix for CVE-2025-67030 (using canonical paths and File.separator checks) that provides even stronger protection, but the simple upstream fix was already sufficient for CVE-2022-4244.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.24), NVD (< 3.0.24), Snyk (< 3.0.24)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.codehaus.plexus/plexus-utils@3.4.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.codehaus.plexus/plexus-utils@3.4.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T03:37:00.143582+00:00",
      "status_notes": "Vulnerability CVE-2022-4245 does not affect version 3.4.1-tuxcare.1 of org.codehaus.plexus:plexus-utils. not_affected \u2014 The target is NOT AFFECTED. The vulnerability pattern (missing sanitization of XML comment delimiters `<!--` and `-->` in XmlWriterUtil.writeComment) is not present in plexus-utils 3.4.1. The upstream fix (commit f933e5e by schulte@apache.org, dated May 8, 2016) was already included in the upstream plexus-utils 3.4.1 release that TuxCare onboarded. Lines 191-199 of XmlWriterUtil.java strip both...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-4245"
      },
      "impact_statement": "not_affected \u2014 The target is NOT AFFECTED. The vulnerability pattern (missing sanitization of XML comment delimiters `<!--` and `-->` in XmlWriterUtil.writeComment) is not present in plexus-utils 3.4.1. The upstream fix (commit f933e5e by schulte@apache.org, dated May 8, 2016) was already included in the upstream plexus-utils 3.4.1 release that TuxCare onboarded. Lines 191-199 of XmlWriterUtil.java strip both..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.codehaus.plexus/plexus-utils@3.4.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.codehaus.plexus/plexus-utils@3.4.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-67030 is fixed in version 3.4.1-tuxcare.1 of org.codehaus.plexus:plexus-utils.",
      "vulnerability": {
        "name": "CVE-2025-67030"
      }
    }
  ]
}