CVE-2022-29599: Commandline class shell injection vulnerabilities

Modified

AliasesRHSA-2022:1541RHSA-2022:1662RHSA-2022:4699+63 more

Published 23-05-2022Last modified 03-08-2024

Vulnerability summary

CVE-2022-29599 is a critical (CVSS 9.8) Improper Encoding or Escaping of Output vulnerability in apache software foundation apache maven. EPSS estimates a 4.42% chance of exploitation in the next 30 days, higher than 91.3% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 9.8 (NVD); no exploitation reported by the 5 checked sources; EPSS 4% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

9.8/10

010

Critical · v3.1 (NVD)

EPSS score

4.42%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 11

RHSA-2023:3198 RHSA-2023:3610 RHSA-2023:3622 RHSA-2023:6171 RHSA-2023:6172 RHSA-2023:6179+5 more

Timeline

23-05-2022
PublishedVulnerability first disclosed.
03-08-2024
Last modifiedVulnerability information updated.

Description

In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks.

CVSS metrics

7 scores · 6 sources · 2 versions

v3.19.8v2.07.5

EPSS trend

Probability

4.42%

Chance of exploitation in the next 30 days

Percentile

91%

Versus all other CVEs

30-day change

No change 0.00 pp

From 4.42% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-116Improper Encoding or Escaping of OutputThe product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat57 products

aopalliance< 0:1.0-17.module+el8+2452+b359bfcd | < 0:1.0-20.module+el8.2.0+5557+11a14461 | < 0:1.0-20.module+el8.3.0+6804+157bd82e | < 0:1.0-20.module+el8.6.0+13337+afcb49ec
apache-commons-cli< 0:1.4-4.module+el8+2452+b359bfcd | < 0:1.4-7.module+el8.2.0+5557+11a14461 | < 0:1.4-7.module+el8.3.0+6804+157bd82e | < 0:1.4-7.module+el8.6.0+13337+afcb49ec
apache-commons-codec< 0:1.11-3.module+el8+2452+b359bfcd | < 0:1.13-3.module+el8.2.0+5557+11a14461 | < 0:1.13-3.module+el8.3.0+6804+157bd82e | < 0:1.13-3.module+el8.6.0+13337+afcb49ec
apache-commons-io< 1:2.6-3.module+el8+2452+b359bfcd | < 1:2.6-6.module+el8.2.0+5557+11a14461 | < 1:2.6-6.module+el8.3.0+6804+157bd82e | < 1:2.6-6.module+el8.6.0+13337+afcb49ec
apache-commons-lang3< 0:3.7-3.module+el8+2452+b359bfcd | < 0:3.9-4.module+el8.2.0+5557+11a14461 | < 0:3.9-4.module+el8.3.0+6804+157bd82e | < 0:3.9-4.module+el8.6.0+13337+afcb49ec

apache-commons-logging< 0:1.2-13.module+el8+2452+b359bfcd
atinject< 0:1-28.20100611svn86.module+el8+2452+b359bfcd | < 0:1-31.20100611svn86.module+el8.2.0+5557+11a14461 | < 0:1-31.20100611svn86.module+el8.3.0+6804+157bd82e | < 0:1-31.20100611svn86.module+el8.6.0+13337+afcb49ec
cdi-api< 0:1.2-8.module+el8+2452+b359bfcd | < 0:2.0.1-3.module+el8.2.0+5557+11a14461 | < 0:2.0.1-3.module+el8.3.0+6804+157bd82e | < 0:2.0.1-3.module+el8.6.0+13337+afcb49ec
geronimo-annotation< 0:1.0-23.module+el8+2452+b359bfcd | < 0:1.0-26.module+el8.2.0+5557+11a14461 | < 0:1.0-26.module+el8.3.0+6804+157bd82e | < 0:1.0-26.module+el8.6.0+13337+afcb49ec
glassfish-el< 0:3.0.1-0.7.b08.module+el8+2452+b359bfcd
glassfish-el-api< 0:3.0.1-0.7.b08.module+el8+2452+b359bfcd
google-guice< 0:4.1-11.module+el8+2452+b359bfcd | < 0:4.2.2-4.module+el8.2.0+5557+11a14461 | < 0:4.2.2-4.module+el8.3.0+6804+157bd82e | < 0:4.2.2-4.module+el8.6.0+13337+afcb49ec
guava< 0:28.1-3.module+el8.2.0+5557+11a14461 | < 0:28.1-3.module+el8.3.0+6804+157bd82e | < 0:28.1-3.module+el8.6.0+13337+afcb49ec
guava20< 0:20.0-8.module+el8+2452+b359bfcd
hawtjni< 0:1.16-2.module+el8+2452+b359bfcd
hawtjni-runtime< 0:1.16-2.module+el8+2452+b359bfcd
httpcomponents-client< 0:4.5.5-4.module+el8+2452+b359bfcd | < 0:4.5.10-3.module+el8.2.0+5557+11a14461 | < 0:4.5.10-3.module+el8.3.0+6804+157bd82e | < 0:4.5.10-4.module+el8.6.0+13337+afcb49ec | < 0:4.5.5-5.module+el8.6.0+13298+7b5243c0
httpcomponents-core< 0:4.4.10-3.module+el8+2452+b359bfcd | < 0:4.4.12-3.module+el8.2.0+5557+11a14461 | < 0:4.4.12-3.module+el8.3.0+6804+157bd82e | < 0:4.4.12-3.module+el8.6.0+13337+afcb49ec
jansi< 0:1.17.1-1.module+el8+2452+b359bfcd | < 0:1.18-4.module+el8.2.0+5557+11a14461 | < 0:1.18-4.module+el8.3.0+6804+157bd82e | < 0:1.18-4.module+el8.6.0+13337+afcb49ec
jansi-native< 0:1.7-7.module+el8+2452+b359bfcd
jboss-interceptors-1.2-api< 0:1.0.0-8.module+el8+2452+b359bfcd
jcl-over-slf4j< 0:1.7.25-4.module+el8+2452+b359bfcd | < 0:1.7.28-3.module+el8.2.0+5557+11a14461 | < 0:1.7.28-3.module+el8.3.0+6804+157bd82e | < 0:1.7.28-3.module+el8.6.0+13337+afcb49ec
jenkins-2-plugins< 0:4.10.1670851835-1.el8 | < 0:4.9.1674644684-1.el8
jsoup< 0:1.11.3-3.module+el8+2452+b359bfcd | < 0:1.12.1-3.module+el8.2.0+5557+11a14461 | < 0:1.12.1-3.module+el8.3.0+6804+157bd82e | < 0:1.12.1-3.module+el8.6.0+13337+afcb49ec
jsr-305< 0:0-0.25.20130910svn.module+el8.2.0+5557+11a14461 | < 0:0-0.25.20130910svn.module+el8.3.0+6804+157bd82e | < 0:0-0.25.20130910svn.module+el8.6.0+13337+afcb49ec
maven< 1:3.5.4-5.module+el8+2452+b359bfcd | < 1:3.6.2-4.module+el8.2.0+5560+b953ed0b | < 1:3.6.2-6.module+el8.4.0+9250+1786af37 | < 1:3.6.2-7.module+el8.6.0+13337+afcb49ec
maven-lib< 1:3.5.4-5.module+el8+2452+b359bfcd | < 1:3.6.2-4.module+el8.2.0+5560+b953ed0b | < 1:3.6.2-6.module+el8.4.0+9250+1786af37 | < 1:3.6.2-7.module+el8.6.0+13337+afcb49ec
maven-openjdk11< 1:3.6.2-4.module+el8.2.0+5560+b953ed0b | < 1:3.6.2-6.module+el8.4.0+9250+1786af37 | < 1:3.6.2-7.module+el8.6.0+13337+afcb49ec
maven-openjdk17< 1:3.6.2-7.module+el8.6.0+13337+afcb49ec
maven-openjdk8< 1:3.6.2-4.module+el8.2.0+5560+b953ed0b | < 1:3.6.2-6.module+el8.4.0+9250+1786af37 | < 1:3.6.2-7.module+el8.6.0+13337+afcb49ec
maven-resolver< 1:1.1.1-2.module+el8+2452+b359bfcd | < 0:1.4.1-3.module+el8.2.0+5557+11a14461 | < 0:1.4.1-3.module+el8.3.0+6804+157bd82e | < 0:1.4.1-3.module+el8.6.0+13337+afcb49ec
maven-resolver-api< 1:1.1.1-2.module+el8+2452+b359bfcd
maven-resolver-connector-basic< 1:1.1.1-2.module+el8+2452+b359bfcd
maven-resolver-impl< 1:1.1.1-2.module+el8+2452+b359bfcd
maven-resolver-spi< 1:1.1.1-2.module+el8+2452+b359bfcd
maven-resolver-transport-wagon< 1:1.1.1-2.module+el8+2452+b359bfcd
maven-resolver-util< 1:1.1.1-2.module+el8+2452+b359bfcd
maven-shared-utils< 0:3.2.1-0.2.module+el8.1.0+15171+4eab2c6b | < 0:3.2.1-0.5.module+el8.2.0+15047+acf0c170 | < 0:3.2.1-0.5.module+el8.4.0+15048+bdaf849b | < 0:3.2.1-0.5.module+el8.6.0+15049+43453910 | < 0:3.2.1-0.2.module+el8.2.0+15046+b52d227a | < 0:3.2.1-0.2.module+el8.4.0+15140+8e8c2c6f | < 0:3.2.1-0.2.module+el8.6.0+15045+b1156105 | < 0:0.4-4.el7_9
maven-shared-utils-javadoc< 0:0.4-4.el7_9
maven-wagon< 0:3.1.0-1.module+el8+2452+b359bfcd | < 0:3.3.4-2.module+el8.2.0+5557+11a14461 | < 0:3.3.4-2.module+el8.3.0+6804+157bd82e | < 0:3.3.4-2.module+el8.6.0+13337+afcb49ec
maven-wagon-file< 0:3.1.0-1.module+el8+2452+b359bfcd
maven-wagon-http< 0:3.1.0-1.module+el8+2452+b359bfcd
maven-wagon-http-shared< 0:3.1.0-1.module+el8+2452+b359bfcd
maven-wagon-provider-api< 0:3.1.0-1.module+el8+2452+b359bfcd
plexus-cipher< 0:1.7-14.module+el8+2452+b359bfcd | < 0:1.7-17.module+el8.2.0+5557+11a14461 | < 0:1.7-17.module+el8.3.0+6804+157bd82e | < 0:1.7-17.module+el8.6.0+13337+afcb49ec
plexus-classworlds< 0:2.5.2-9.module+el8+2452+b359bfcd | < 0:2.6.0-4.module+el8.2.0+5557+11a14461 | < 0:2.6.0-4.module+el8.3.0+6804+157bd82e | < 0:2.6.0-4.module+el8.6.0+13337+afcb49ec
plexus-containers< 0:1.7.1-8.module+el8+2452+b359bfcd | < 0:2.1.0-2.module+el8.2.0+5557+11a14461 | < 0:2.1.0-2.module+el8.3.0+6804+157bd82e | < 0:2.1.0-2.module+el8.6.0+13337+afcb49ec
plexus-containers-component-annotations< 0:1.7.1-8.module+el8+2452+b359bfcd | < 0:2.1.0-2.module+el8.2.0+5557+11a14461 | < 0:2.1.0-2.module+el8.3.0+6804+157bd82e | < 0:2.1.0-2.module+el8.6.0+13337+afcb49ec
plexus-interpolation< 0:1.22-9.module+el8+2452+b359bfcd | < 0:1.26-3.module+el8.2.0+5557+11a14461 | < 0:1.26-3.module+el8.3.0+6804+157bd82e | < 0:1.26-3.module+el8.6.0+13337+afcb49ec
plexus-sec-dispatcher< 0:1.4-26.module+el8+2452+b359bfcd | < 0:1.4-29.module+el8.2.0+5557+11a14461 | < 0:1.4-29.module+el8.3.0+6804+157bd82e | < 0:1.4-29.module+el8.6.0+13337+afcb49ec
plexus-utils< 0:3.1.0-3.module+el8+2452+b359bfcd | < 0:3.3.0-3.module+el8.2.0+5557+11a14461 | < 0:3.3.0-3.module+el8.3.0+6804+157bd82e | < 0:3.3.0-3.module+el8.6.0+13337+afcb49ec
rh-maven36-maven-shared-utils< 0:3.2.1-0.2.3.el7
rh-maven36-maven-shared-utils-javadoc< 0:3.2.1-0.2.3.el7
sisu< 1:0.3.3-6.module+el8+2452+b359bfcd | < 0:0.3.4-2.module+el8.2.0+5557+11a14461 | < 0:0.3.4-2.module+el8.3.0+6804+157bd82e | < 0:0.3.4-2.module+el8.6.0+13337+afcb49ec
sisu-inject< 1:0.3.3-6.module+el8+2452+b359bfcd
sisu-plexus< 1:0.3.3-6.module+el8+2452+b359bfcd
slf4j< 0:1.7.25-4.module+el8+2452+b359bfcd | < 0:1.7.28-3.module+el8.2.0+5557+11a14461 | < 0:1.7.28-3.module+el8.3.0+6804+157bd82e | < 0:1.7.28-3.module+el8.6.0+13337+afcb49ec

Show all 57

Chainguard3 products

hadoop-fips-3.3.6All versions (No fix recorded)
hadoop-fips-3.4.2All versions (No fix recorded)
hadoop-fips-3.5All versions (No fix recorded)

Debian2 products

maven-shared-utils< 3.3.0-1+deb11u1 | < 3.0.0-1+deb9u1 | < 3.3.0-1+deb10u1 | < 3.3.4-1
debian_linuxEOL10.0 | 11.0

Apache1 product

maven_shared_utils< 3.3.3

Apache software foundation1 product

apache maven≥ maven-shared-utils, < 3.3.3

Org.apache.maven.shared1 product

maven-shared-utils< 3.3.3

Ubuntu1 product

maven-shared-utils< 0.4-1ubuntu0.1~esm1 | < 0.9-1ubuntu0.1~esm1 | < 3.3.0-1ubuntu0.18.04.1~esm1 | < 3.3.0-1ubuntu0.20.04.1 | < 3.3.0-1ubuntu0.22.04.1

7 vendors · 66 products

References

30 links

issues.apache.org/jira/browse/MSHARED-297X Refsource MISCWEBPatchVendor Advisory
github.com/apache/maven-shared-utils/pull/40X Refsource MISCWEBPatchThird Party Advisory
www.openwall.com/lists/oss-security/2022/05/23/3Mailing ListX Refsource MLISTWEBThird Party Advisory
lists.debian.org/debian-lts-announce/2022/08/msg00018.htmlMailing ListX Refsource MLISTWEBThird Party Advisory
www.debian.org/security/2022/dsa-5242Vendor AdvisoryX Refsource DEBIANWEBThird Party Advisory
access.redhat.com/errata/RHSA-2022:1541Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=2066479REPORT
security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1541.jsonAdvisory
access.redhat.com/security/cve/CVE-2022-29599REPORT

Show all 30 references