{
  "@id": "urn:uuid:b557b507-2f0c-4b92-bb9f-c5b5c8be0fdb",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 5,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:08:14.959299+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:08:14.959299+00:00",
      "status_notes": "Vulnerability CVE-2017-1000487 does not affect version 3.5.1-tuxcare.1 of org.codehaus.plexus:plexus-utils. CVE-2017-1000487 (command injection via improper shell metacharacter handling) is NOT present in plexus-utils 3.5.1. The upstream fix (commit b38a1b3a4352303e4312b2bb601a0d7ec6e28f41 by Kristian Rosenvold, Oct 2013) was already included in the upstream release 3.5.1 that TuxCare onboarded in July 2026. All three defense components are present: (1) unconditional single-quote wrapping of all arguments/executables via setUnconditionalQuoting(true), (2) proper escaping of embedded single quotes using the pattern '\\\"'\\\"', and (3) execute() method uses getCommandline() instead of getShellCommandline() to bypass shell interpretation entirely.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.16), NVD (< 3.0.16), Snyk (< 3.0.16).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-1000487"
      },
      "impact_statement": "CVE-2017-1000487 (command injection via improper shell metacharacter handling) is NOT present in plexus-utils 3.5.1. The upstream fix (commit b38a1b3a4352303e4312b2bb601a0d7ec6e28f41 by Kristian Rosenvold, Oct 2013) was already included in the upstream release 3.5.1 that TuxCare onboarded in July 2026. All three defense components are present: (1) unconditional single-quote wrapping of all arguments/executables via setUnconditionalQuoting(true), (2) proper escaping of embedded single quotes using the pattern '\\\"'\\\"', and (3) execute() method uses getCommandline() instead of getShellCommandline() to bypass shell interpretation entirely.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.16), NVD (< 3.0.16), Snyk (< 3.0.16)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T11:58:00.062525+00:00",
      "status_notes": "Vulnerability CVE-2022-4244 does not affect version 3.5.1-tuxcare.1 of org.codehaus.plexus:plexus-utils. CVE-2022-4244 directory traversal vulnerability is NOT present in plexus-utils 3.5.1. The fix was already included in the upstream release before TuxCare onboarded this version. The upstream fix (commit 33a2853 by Christian Schulte, May 2016) adds validation in the extractFile() method to prevent extracting files outside the target directory using getAbsolutePath().startsWith() check. This fix was later enhanced in CVE-2025-67030 to use getCanonicalPath() for additional hardening, but the original CVE-2022-4244 mitigation has been present since upstream version 3.3.0 (2016).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.24), NVD (< 3.0.24), Snyk (< 3.0.24).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-4244"
      },
      "impact_statement": "CVE-2022-4244 directory traversal vulnerability is NOT present in plexus-utils 3.5.1. The fix was already included in the upstream release before TuxCare onboarded this version. The upstream fix (commit 33a2853 by Christian Schulte, May 2016) adds validation in the extractFile() method to prevent extracting files outside the target directory using getAbsolutePath().startsWith() check. This fix was later enhanced in CVE-2025-67030 to use getCanonicalPath() for additional hardening, but the original CVE-2022-4244 mitigation has been present since upstream version 3.3.0 (2016).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.24), NVD (< 3.0.24), Snyk (< 3.0.24)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T03:29:00.119787+00:00",
      "status_notes": "Vulnerability CVE-2022-4245 does not affect version 3.5.1-tuxcare.1 of org.codehaus.plexus:plexus-utils. not_affected \u2014 CVE-2022-4245 (XML injection via unsanitized comment sequences) is NOT present in plexus-utils 3.5.1. The upstream fix (commit f933e5e by Christian Schulte, May 2016) that removes `<!--` and `-->` sequences from XML comments was already included in the upstream 3.5.1 release before TuxCare onboarded it (July 2026). All writeComment methods delegate to the protected implementation at lines 191-1...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-4245"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-4245 (XML injection via unsanitized comment sequences) is NOT present in plexus-utils 3.5.1. The upstream fix (commit f933e5e by Christian Schulte, May 2016) that removes `<!--` and `-->` sequences from XML comments was already included in the upstream 3.5.1 release before TuxCare onboarded it (July 2026). All writeComment methods delegate to the protected implementation at lines 191-1..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-67030 is fixed in version 3.5.1-tuxcare.1 of org.codehaus.plexus:plexus-utils.",
      "vulnerability": {
        "name": "CVE-2025-67030"
      }
    }
  ]
}