{
  "@id": "urn:uuid:958733d1-19bd-4c64-a88f-78ccb7a69bf7",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 5,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:13:29.842653+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.codehaus.plexus/plexus-utils@4.0.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.codehaus.plexus/plexus-utils@4.0.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:13:29.842653+00:00",
      "status_notes": "Vulnerability CVE-2017-1000487 does not affect version 4.0.0-tuxcare.1 of org.codehaus.plexus:plexus-utils. CVE-2017-1000487 (command injection via improper processing of double-quoted strings in shell commands) is NOT present in plexus-utils 4.0.0-tuxcare.1. The upstream fix (commit b38a1b3a4352303e4312b2bb601a0d7ec6e28f41 from October 2013) was already included in the plexus-utils 4.0.0 release before TuxCare onboarded this version in August 2026. The fix prevents shell injection by avoiding shell interpretation entirely on non-Windows systems - the execute() method calls getCommandline() which returns a String[] passed directly to Runtime.exec() without invoking a shell.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.16), NVD (< 3.0.16), Snyk (< 3.0.16).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-1000487"
      },
      "impact_statement": "CVE-2017-1000487 (command injection via improper processing of double-quoted strings in shell commands) is NOT present in plexus-utils 4.0.0-tuxcare.1. The upstream fix (commit b38a1b3a4352303e4312b2bb601a0d7ec6e28f41 from October 2013) was already included in the plexus-utils 4.0.0 release before TuxCare onboarded this version in August 2026. The fix prevents shell injection by avoiding shell interpretation entirely on non-Windows systems - the execute() method calls getCommandline() which returns a String[] passed directly to Runtime.exec() without invoking a shell.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.16), NVD (< 3.0.16), Snyk (< 3.0.16)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.codehaus.plexus/plexus-utils@4.0.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.codehaus.plexus/plexus-utils@4.0.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:04:03.421384+00:00",
      "status_notes": "Vulnerability CVE-2022-4244 does not affect version 4.0.0-tuxcare.1 of org.codehaus.plexus:plexus-utils. CVE-2022-4244 (directory traversal in plexus-utils Expand class) is NOT affecting version 4.0.0. The upstream vendor (Christian Schulte) fixed this vulnerability in commit 33a2853 (May 2016), which was included in the upstream 4.0.0 release (May 2023) before TuxCare onboarded it. The current code contains an even more robust version of the fix using canonical paths (added via CVE-2025-67030 backport). The vulnerable pattern is not present in HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.24), NVD (< 3.0.24), Snyk (< 3.0.24).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-4244"
      },
      "impact_statement": "CVE-2022-4244 (directory traversal in plexus-utils Expand class) is NOT affecting version 4.0.0. The upstream vendor (Christian Schulte) fixed this vulnerability in commit 33a2853 (May 2016), which was included in the upstream 4.0.0 release (May 2023) before TuxCare onboarded it. The current code contains an even more robust version of the fix using canonical paths (added via CVE-2025-67030 backport). The vulnerable pattern is not present in HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.24), NVD (< 3.0.24), Snyk (< 3.0.24)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.codehaus.plexus/plexus-utils@4.0.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.codehaus.plexus/plexus-utils@4.0.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T03:36:00.560221+00:00",
      "status_notes": "Vulnerability CVE-2022-4245 does not affect version 4.0.0-tuxcare.1 of org.codehaus.plexus:plexus-utils. not_affected \u2014 plexus-utils version 4.0.0 is NOT AFFECTED by CVE-2022-4245. The vulnerable class org.codehaus.plexus.util.xml.XmlWriterUtil and its writeComment method do not exist in this version. The entire xml package (org.codehaus.plexus.util.xml) was extracted to a separate artifact (plexus-xml) as part of the upstream architectural refactoring for version 4.0.0. The removal was performed by upstream mai...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-4245"
      },
      "impact_statement": "not_affected \u2014 plexus-utils version 4.0.0 is NOT AFFECTED by CVE-2022-4245. The vulnerable class org.codehaus.plexus.util.xml.XmlWriterUtil and its writeComment method do not exist in this version. The entire xml package (org.codehaus.plexus.util.xml) was extracted to a separate artifact (plexus-xml) as part of the upstream architectural refactoring for version 4.0.0. The removal was performed by upstream mai..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.codehaus.plexus/plexus-utils@4.0.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.codehaus.plexus/plexus-utils@4.0.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-67030 is fixed in version 4.0.0-tuxcare.1 of org.codehaus.plexus:plexus-utils.",
      "vulnerability": {
        "name": "CVE-2025-67030"
      }
    }
  ]
}