{
  "@id": "urn:uuid:22968bd3-ff1b-4115-a531-f37806b09514",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 5,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:14:20.152420+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.codehaus.plexus/plexus-utils@4.0.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.codehaus.plexus/plexus-utils@4.0.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:14:20.152420+00:00",
      "status_notes": "Vulnerability CVE-2017-1000487 does not affect version 4.0.1-tuxcare.1 of org.codehaus.plexus:plexus-utils. The target plexus-utils version 4.0.1 is NOT affected by CVE-2017-1000487. The vulnerability (command injection via improper double-quote handling in shell command execution) was fixed upstream in version 3.0.16 (commit b38a1b3a by Kristian Rosenvold on 2013-10-23). The fix was already present in the upstream release 4.0.1 that TuxCare onboarded. The target code uses single-quote wrapping (preventing all shell metacharacter expansion) and calls getCommandline() instead of getShellCommandline() in the execute() method, matching the upstream fix exactly.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.16), NVD (< 3.0.16), Snyk (< 3.0.16).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-1000487"
      },
      "impact_statement": "The target plexus-utils version 4.0.1 is NOT affected by CVE-2017-1000487. The vulnerability (command injection via improper double-quote handling in shell command execution) was fixed upstream in version 3.0.16 (commit b38a1b3a by Kristian Rosenvold on 2013-10-23). The fix was already present in the upstream release 4.0.1 that TuxCare onboarded. The target code uses single-quote wrapping (preventing all shell metacharacter expansion) and calls getCommandline() instead of getShellCommandline() in the execute() method, matching the upstream fix exactly.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.16), NVD (< 3.0.16), Snyk (< 3.0.16)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.codehaus.plexus/plexus-utils@4.0.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.codehaus.plexus/plexus-utils@4.0.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:06:05.431502+00:00",
      "status_notes": "Vulnerability CVE-2022-4244 does not affect version 4.0.1-tuxcare.1 of org.codehaus.plexus:plexus-utils. CVE-2022-4244 is not present in plexus-utils 4.0.1-tuxcare.1. The upstream fix (commit 33a2853) that adds directory traversal protection to Expand.java was already included in the upstream 4.0.1 release before TuxCare onboarded it. The code validates that extracted file paths remain within the target directory boundary, preventing malicious archive entries with '../' sequences or absolute paths from writing files outside the intended location. The current implementation uses canonical path validation (lines 115-124), which is even stronger than the original fix due to CVE-2025-67030 improvements.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.24), NVD (< 3.0.24), Snyk (< 3.0.24).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-4244"
      },
      "impact_statement": "CVE-2022-4244 is not present in plexus-utils 4.0.1-tuxcare.1. The upstream fix (commit 33a2853) that adds directory traversal protection to Expand.java was already included in the upstream 4.0.1 release before TuxCare onboarded it. The code validates that extracted file paths remain within the target directory boundary, preventing malicious archive entries with '../' sequences or absolute paths from writing files outside the intended location. The current implementation uses canonical path validation (lines 115-124), which is even stronger than the original fix due to CVE-2025-67030 improvements.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.24), NVD (< 3.0.24), Snyk (< 3.0.24)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.codehaus.plexus/plexus-utils@4.0.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.codehaus.plexus/plexus-utils@4.0.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T03:37:00.143582+00:00",
      "status_notes": "Vulnerability CVE-2022-4245 does not affect version 4.0.1-tuxcare.1 of org.codehaus.plexus:plexus-utils. not_affected \u2014 CVE-2022-4245 does not affect plexus-utils 4.0.1. The vulnerable class XmlWriterUtil and its writeComment method do not exist in this version. The entire XML package (org.codehaus.plexus.util.xml) was removed in the upstream version 4.x architectural refactoring (commit 8bf874bb, March 2023, by hboutemy@apache.org) before TuxCare onboarding. XML functionality was extracted to a separate plexus-...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-4245"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-4245 does not affect plexus-utils 4.0.1. The vulnerable class XmlWriterUtil and its writeComment method do not exist in this version. The entire XML package (org.codehaus.plexus.util.xml) was removed in the upstream version 4.x architectural refactoring (commit 8bf874bb, March 2023, by hboutemy@apache.org) before TuxCare onboarding. XML functionality was extracted to a separate plexus-..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.codehaus.plexus/plexus-utils@4.0.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.codehaus.plexus/plexus-utils@4.0.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-67030 is fixed in version 4.0.1-tuxcare.1 of org.codehaus.plexus:plexus-utils.",
      "vulnerability": {
        "name": "CVE-2025-67030"
      }
    }
  ]
}