{
  "@id": "urn:uuid:f00f5ab4-8018-4e9c-8cc5-3c53ba15924b",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 5,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:14:20.152420+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.codehaus.plexus/plexus-utils@3.6.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.codehaus.plexus/plexus-utils@3.6.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:14:20.152420+00:00",
      "status_notes": "Vulnerability CVE-2017-1000487 does not affect version 3.6.0-tuxcare.1 of org.codehaus.plexus:plexus-utils. CVE-2017-1000487 is NOT present in plexus-utils 3.6.0. The upstream vendor fix (commit b38a1b3a4352303e4312b2bb601a0d7ec6e28f41 by Kristian Rosenvold) was already included in version 3.6.0 when TuxCare onboarded it. The fix addresses shell injection by: (1) switching from double-quote to single-quote delimiters with unconditional quoting, (2) properly escaping single quotes using the '\\\"'\\\"' pattern, and (3) replacing shell-interpreted execution (getShellCommandline) with direct array-based execution (getCommandline) on Unix systems. All three defensive measures are confirmed present in the target code at HEAD (d0a55de7321275a4ac9fff45991368628b88bdb9).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.16), NVD (< 3.0.16), Snyk (< 3.0.16).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-1000487"
      },
      "impact_statement": "CVE-2017-1000487 is NOT present in plexus-utils 3.6.0. The upstream vendor fix (commit b38a1b3a4352303e4312b2bb601a0d7ec6e28f41 by Kristian Rosenvold) was already included in version 3.6.0 when TuxCare onboarded it. The fix addresses shell injection by: (1) switching from double-quote to single-quote delimiters with unconditional quoting, (2) properly escaping single quotes using the '\\\"'\\\"' pattern, and (3) replacing shell-interpreted execution (getShellCommandline) with direct array-based execution (getCommandline) on Unix systems. All three defensive measures are confirmed present in the target code at HEAD (d0a55de7321275a4ac9fff45991368628b88bdb9).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.16), NVD (< 3.0.16), Snyk (< 3.0.16)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.codehaus.plexus/plexus-utils@3.6.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.codehaus.plexus/plexus-utils@3.6.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:05:17.011429+00:00",
      "status_notes": "Vulnerability CVE-2022-4244 does not affect version 3.6.0-tuxcare.1 of org.codehaus.plexus:plexus-utils. CVE-2022-4244 path traversal vulnerability is NOT present in plexus-utils 3.6.0-tuxcare.1. The upstream fix (commit 33a2853) was already included in version 3.6.0 when TuxCare onboarded it. The fix validates that extracted archive entries remain within the target directory by checking canonical paths before file operations. This defense was later enhanced by CVE-2025-67030 backport (commit 2bf063c) to use getCanonicalPath() instead of getAbsolutePath() and add file separator validation, making it even more robust against symlink-based attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.24), NVD (< 3.0.24), Snyk (< 3.0.24).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-4244"
      },
      "impact_statement": "CVE-2022-4244 path traversal vulnerability is NOT present in plexus-utils 3.6.0-tuxcare.1. The upstream fix (commit 33a2853) was already included in version 3.6.0 when TuxCare onboarded it. The fix validates that extracted archive entries remain within the target directory by checking canonical paths before file operations. This defense was later enhanced by CVE-2025-67030 backport (commit 2bf063c) to use getCanonicalPath() instead of getAbsolutePath() and add file separator validation, making it even more robust against symlink-based attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.24), NVD (< 3.0.24), Snyk (< 3.0.24)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.codehaus.plexus/plexus-utils@3.6.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.codehaus.plexus/plexus-utils@3.6.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T03:35:02.645130+00:00",
      "status_notes": "Vulnerability CVE-2022-4245 does not affect version 3.6.0-tuxcare.1 of org.codehaus.plexus:plexus-utils. not_affected \u2014 The target repository (plexus-utils 3.6.0-tuxcare.1) is not affected by CVE-2022-4245. The vulnerability fix was already present in the upstream release 3.6.0 that TuxCare onboarded. The fix commit f933e5e by Christian Schulte (schulte@apache.org) from 2016 adds sanitization to XmlWriterUtil.writeComment() that removes all '<!--' and '-->' sequences from comment text before writing, preventing ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-4245"
      },
      "impact_statement": "not_affected \u2014 The target repository (plexus-utils 3.6.0-tuxcare.1) is not affected by CVE-2022-4245. The vulnerability fix was already present in the upstream release 3.6.0 that TuxCare onboarded. The fix commit f933e5e by Christian Schulte (schulte@apache.org) from 2016 adds sanitization to XmlWriterUtil.writeComment() that removes all '<!--' and '-->' sequences from comment text before writing, preventing ..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.codehaus.plexus/plexus-utils@3.6.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.codehaus.plexus/plexus-utils@3.6.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-67030 is fixed in version 3.6.0-tuxcare.1 of org.codehaus.plexus:plexus-utils.",
      "vulnerability": {
        "name": "CVE-2025-67030"
      }
    }
  ]
}