{
  "@id": "urn:uuid:aa72728d-4bc1-46b5-a2a5-21aac7fa8d72",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 5,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:14:20.152420+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.codehaus.plexus/plexus-utils@4.0.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.codehaus.plexus/plexus-utils@4.0.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:14:20.152420+00:00",
      "status_notes": "Vulnerability CVE-2017-1000487 does not affect version 4.0.2-tuxcare.1 of org.codehaus.plexus:plexus-utils. CVE-2017-1000487 affects plexus-utils before version 3.0.16. The target repository is version 4.0.2-tuxcare.1, which already contains the upstream security fix (commit b38a1b3a) that was introduced in version 3.0.16. The vulnerable double-quote quoting mechanism has been replaced with single-quote quoting that prevents shell metacharacter expansion, and command execution no longer invokes the shell on Unix systems. The fix was authored by Kristian Rosenvold (krosenvold@apache.org) and shipped in the upstream release that TuxCare onboarded, not applied as a separate TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.16), NVD (< 3.0.16), Snyk (< 3.0.16).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-1000487"
      },
      "impact_statement": "CVE-2017-1000487 affects plexus-utils before version 3.0.16. The target repository is version 4.0.2-tuxcare.1, which already contains the upstream security fix (commit b38a1b3a) that was introduced in version 3.0.16. The vulnerable double-quote quoting mechanism has been replaced with single-quote quoting that prevents shell metacharacter expansion, and command execution no longer invokes the shell on Unix systems. The fix was authored by Kristian Rosenvold (krosenvold@apache.org) and shipped in the upstream release that TuxCare onboarded, not applied as a separate TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.16), NVD (< 3.0.16), Snyk (< 3.0.16)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.codehaus.plexus/plexus-utils@4.0.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.codehaus.plexus/plexus-utils@4.0.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:05:17.011429+00:00",
      "status_notes": "Vulnerability CVE-2022-4244 does not affect version 4.0.2-tuxcare.1 of org.codehaus.plexus:plexus-utils. CVE-2022-4244 directory traversal vulnerability is NOT present in plexus-utils 4.0.2. The upstream fix (commit 33a2853d by Christian Schulte, 2016-05-08) was already included in the upstream 4.0.2 release before TuxCare onboarding. The fix adds path validation in Expand.extractFile() to reject archive entries that would escape the target directory. Target version 4.0.2 additionally has the CVE-2025-67030 superseding fix (canonical path validation), further strengthening the defense.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.24), NVD (< 3.0.24), Snyk (< 3.0.24).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-4244"
      },
      "impact_statement": "CVE-2022-4244 directory traversal vulnerability is NOT present in plexus-utils 4.0.2. The upstream fix (commit 33a2853d by Christian Schulte, 2016-05-08) was already included in the upstream 4.0.2 release before TuxCare onboarding. The fix adds path validation in Expand.extractFile() to reject archive entries that would escape the target directory. Target version 4.0.2 additionally has the CVE-2025-67030 superseding fix (canonical path validation), further strengthening the defense.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.24), NVD (< 3.0.24), Snyk (< 3.0.24)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.codehaus.plexus/plexus-utils@4.0.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.codehaus.plexus/plexus-utils@4.0.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T03:37:00.143582+00:00",
      "status_notes": "Vulnerability CVE-2022-4245 does not affect version 4.0.2-tuxcare.1 of org.codehaus.plexus:plexus-utils. not_affected \u2014 Version 4.0.2 is not affected by CVE-2022-4245. The vulnerable class org.codehaus.plexus.util.xml.XmlWriterUtil and its writeComment method do not exist in this version. The entire xml package was removed from plexus-utils in upstream commit 8bf874b (April 2023) before version 4.0.0 was released. XML functionality was extracted to a separate module (plexus-xml). Since the vulnerable code has ne...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-4245"
      },
      "impact_statement": "not_affected \u2014 Version 4.0.2 is not affected by CVE-2022-4245. The vulnerable class org.codehaus.plexus.util.xml.XmlWriterUtil and its writeComment method do not exist in this version. The entire xml package was removed from plexus-utils in upstream commit 8bf874b (April 2023) before version 4.0.0 was released. XML functionality was extracted to a separate module (plexus-xml). Since the vulnerable code has ne..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.codehaus.plexus/plexus-utils@4.0.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.codehaus.plexus/plexus-utils@4.0.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-67030 is fixed in version 4.0.2-tuxcare.1 of org.codehaus.plexus:plexus-utils.",
      "vulnerability": {
        "name": "CVE-2025-67030"
      }
    }
  ]
}