~ / search / GHSA-8vhq-qq4p-grq3

GHSA-8vhq-qq4p-grq3

OS Command Injection in Plexus-utils

Source: GitHub Advisory Database (reviewed) Critical CVE-2017-1000487

Packages

EcosystemPackageAffectedFixed in
Maven org.codehaus.plexus:plexus-utils < 3.0.16 3.0.16

Details

As written in the advisory (Markdown source, shown as plain text).

Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.

References

External links from the advisory. They lead to third-party sites.