{
  "@id": "urn:uuid:d6085ae4-9733-49aa-873e-5e4250039500",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 5,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:09:40.812233+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.codehaus.plexus/plexus-utils@3.3.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.codehaus.plexus/plexus-utils@3.3.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:09:40.812233+00:00",
      "status_notes": "Vulnerability CVE-2017-1000487 does not affect version 3.3.1-tuxcare.1 of org.codehaus.plexus:plexus-utils. Target plexus-utils 3.3.1 is not affected by CVE-2017-1000487. The vulnerability (command injection via inadequate double-quote escaping in shell command construction) was fixed in upstream commit b38a1b3 (Oct 2013) by switching to single-quote-based unconditional quoting. This fix shipped in upstream release 3.3.1 (Dec 2021), before TuxCare maintenance began. The target contains the fixed code (BourneShell.java uses setUnconditionalQuoting(true), single-quote delimiters, and the secure quoteOneItem() method). CVE affected range: < 3.0.16; target version: 3.3.1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.16), NVD (< 3.0.16), Snyk (< 3.0.16).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-1000487"
      },
      "impact_statement": "Target plexus-utils 3.3.1 is not affected by CVE-2017-1000487. The vulnerability (command injection via inadequate double-quote escaping in shell command construction) was fixed in upstream commit b38a1b3 (Oct 2013) by switching to single-quote-based unconditional quoting. This fix shipped in upstream release 3.3.1 (Dec 2021), before TuxCare maintenance began. The target contains the fixed code (BourneShell.java uses setUnconditionalQuoting(true), single-quote delimiters, and the secure quoteOneItem() method). CVE affected range: < 3.0.16; target version: 3.3.1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.16), NVD (< 3.0.16), Snyk (< 3.0.16)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.codehaus.plexus/plexus-utils@3.3.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.codehaus.plexus/plexus-utils@3.3.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T11:59:58.922832+00:00",
      "status_notes": "Vulnerability CVE-2022-4244 does not affect version 3.3.1-tuxcare.1 of org.codehaus.plexus:plexus-utils. CVE-2022-4244 does not affect plexus-utils version 3.3.1-tuxcare.1. The vulnerability is a directory traversal attack in archive extraction that allows writing files outside the intended directory via malicious entry names containing path traversal sequences (../) or absolute paths. The upstream vendor (codehaus-plexus) fixed this in commit 33a2853 (May 2016) by adding a path validation check in Expand.java's extractFile method. This fix was already present in upstream version 3.3.1 before TuxCare onboarded it. The current target contains an even more robust protection (canonical path checking) added later for CVE-2025-67030, but the original upstream fix already addressed CVE-2022-4244.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.24), NVD (< 3.0.24), Snyk (< 3.0.24).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-4244"
      },
      "impact_statement": "CVE-2022-4244 does not affect plexus-utils version 3.3.1-tuxcare.1. The vulnerability is a directory traversal attack in archive extraction that allows writing files outside the intended directory via malicious entry names containing path traversal sequences (../) or absolute paths. The upstream vendor (codehaus-plexus) fixed this in commit 33a2853 (May 2016) by adding a path validation check in Expand.java's extractFile method. This fix was already present in upstream version 3.3.1 before TuxCare onboarded it. The current target contains an even more robust protection (canonical path checking) added later for CVE-2025-67030, but the original upstream fix already addressed CVE-2022-4244.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.24), NVD (< 3.0.24), Snyk (< 3.0.24)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.codehaus.plexus/plexus-utils@3.3.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.codehaus.plexus/plexus-utils@3.3.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T03:32:00.171854+00:00",
      "status_notes": "Vulnerability CVE-2022-4245 does not affect version 3.3.1-tuxcare.1 of org.codehaus.plexus:plexus-utils. not_affected \u2014 CVE-2022-4245 (XML injection via unsanitized comment delimiters in XmlWriterUtil#writeComment) is NOT present in plexus-utils 3.3.1. The upstream fix (commit f933e5e by Christian Schulte, May 2016) was already included in the upstream release that TuxCare onboarded. The vulnerable pattern - writing user-supplied comment text without sanitizing `<!--` and `-->` sequences - does not exist in the ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-4245"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-4245 (XML injection via unsanitized comment delimiters in XmlWriterUtil#writeComment) is NOT present in plexus-utils 3.3.1. The upstream fix (commit f933e5e by Christian Schulte, May 2016) was already included in the upstream release that TuxCare onboarded. The vulnerable pattern - writing user-supplied comment text without sanitizing `<!--` and `-->` sequences - does not exist in the ..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.codehaus.plexus/plexus-utils@3.3.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.codehaus.plexus/plexus-utils@3.3.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-67030 is fixed in version 3.3.1-tuxcare.1 of org.codehaus.plexus:plexus-utils.",
      "vulnerability": {
        "name": "CVE-2025-67030"
      }
    }
  ]
}