{
  "@id": "urn:uuid:8b5e4a17-58ee-41fa-9e32-3319c50d4186",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 5,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:08:58.427102+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.codehaus.plexus/plexus-utils@3.1.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.codehaus.plexus/plexus-utils@3.1.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:08:58.427102+00:00",
      "status_notes": "Vulnerability CVE-2017-1000487 does not affect version 3.1.0-tuxcare.1 of org.codehaus.plexus:plexus-utils. The target (plexus-utils 3.1.0-tuxcare.1) is not affected by CVE-2017-1000487. The vulnerability pattern (command injection via improper double-quote processing) is not present in this version. The upstream fix by Kristian Rosenvold (commit b38a1b3, 2013-10-08) was already included in plexus-utils version 3.1.0 (released 2017-08-03) when TuxCare onboarded it. The fix eliminates shell interpretation on Unix/Linux systems and implements proper single-quote-based unconditional escaping. All vulnerable code patterns have been replaced with secure implementations.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.16), NVD (< 3.0.16), Snyk (< 3.0.16).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-1000487"
      },
      "impact_statement": "The target (plexus-utils 3.1.0-tuxcare.1) is not affected by CVE-2017-1000487. The vulnerability pattern (command injection via improper double-quote processing) is not present in this version. The upstream fix by Kristian Rosenvold (commit b38a1b3, 2013-10-08) was already included in plexus-utils version 3.1.0 (released 2017-08-03) when TuxCare onboarded it. The fix eliminates shell interpretation on Unix/Linux systems and implements proper single-quote-based unconditional escaping. All vulnerable code patterns have been replaced with secure implementations.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.16), NVD (< 3.0.16), Snyk (< 3.0.16)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.codehaus.plexus/plexus-utils@3.1.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.codehaus.plexus/plexus-utils@3.1.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T11:58:46.516698+00:00",
      "status_notes": "Vulnerability CVE-2022-4244 does not affect version 3.1.0-tuxcare.1 of org.codehaus.plexus:plexus-utils. CVE-2022-4244 directory traversal vulnerability is not present in plexus-utils 3.1.0. The fix (commit 33a2853 by Christian Schulte) was already included in the upstream version 3.1.0 release that TuxCare onboarded. The Expand.java extractFile method at HEAD contains directory traversal protection that validates extracted file paths remain within the target directory boundary before extraction.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.24), NVD (< 3.0.24), Snyk (< 3.0.24).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-4244"
      },
      "impact_statement": "CVE-2022-4244 directory traversal vulnerability is not present in plexus-utils 3.1.0. The fix (commit 33a2853 by Christian Schulte) was already included in the upstream version 3.1.0 release that TuxCare onboarded. The Expand.java extractFile method at HEAD contains directory traversal protection that validates extracted file paths remain within the target directory boundary before extraction.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.24), NVD (< 3.0.24), Snyk (< 3.0.24)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.codehaus.plexus/plexus-utils@3.1.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.codehaus.plexus/plexus-utils@3.1.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T03:32:00.171854+00:00",
      "status_notes": "Vulnerability CVE-2022-4245 does not affect version 3.1.0-tuxcare.1 of org.codehaus.plexus:plexus-utils. not_affected \u2014 CVE-2022-4245 does not affect plexus-utils 3.1.0 because the vulnerability was already fixed in the upstream release. The upstream commit f933e5e (by Christian Schulte, schulte@apache.org) added sanitization to remove '<!--' and '-->' sequences from XML comments before the 3.1.0 release was tagged. TuxCare onboarded version 3.1.0 which already included this fix. The vulnerable code pattern (uns...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-4245"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-4245 does not affect plexus-utils 3.1.0 because the vulnerability was already fixed in the upstream release. The upstream commit f933e5e (by Christian Schulte, schulte@apache.org) added sanitization to remove '<!--' and '-->' sequences from XML comments before the 3.1.0 release was tagged. TuxCare onboarded version 3.1.0 which already included this fix. The vulnerable code pattern (uns..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.codehaus.plexus/plexus-utils@3.1.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.codehaus.plexus/plexus-utils@3.1.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-67030 is fixed in version 3.1.0-tuxcare.1 of org.codehaus.plexus:plexus-utils.",
      "vulnerability": {
        "name": "CVE-2025-67030"
      }
    }
  ]
}