Skip to content
Fencer Intel
critical 9.8

CVE-2022-29599 json

Commandline class shell injection vulnerabilities

published 4y ago modified 4mo ago also GHSA-rhgr-952r-6p8q , EUVD-2022-5176

cvss
9.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
4.4%
EPSS 4.4% chance of exploitation in 30 days, percentile 91%
public exploits
0
none known

Summary

In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks.

Patch / fix

  • maven org.apache.maven.shared:maven-shared-utils 3.3.3
  • Apache Software Foundation Apache Maven 3.3.3
  • maven-shared-utils Debian 14, Debian 13, Debian 12 3.3.4-1

debian advisories DEBIAN-CVE-2022-29599

  • maven-shared-utils Ubuntu 20.04 LTS 3.3.0-1ubuntu0.20.04.1
  • maven-shared-utils Ubuntu 22.04 LTS 3.3.0-1ubuntu0.22.04.1
  • maven-shared-utils Ubuntu Pro 14.04 LTS 0.4-1ubuntu0.1~esm1
  • maven-shared-utils Ubuntu Pro 16.04 LTS 0.9-1ubuntu0.1~esm1
  • maven-shared-utils Ubuntu Pro 18.04 LTS 3.3.0-1ubuntu0.18.04.1~esm1

ubuntu advisories UBUNTU-CVE-2022-29599

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • jenkins ocp tools 4.13 2.414.3.1698292201-3.el8
  • jenkins-2-plugins ocp tools 4.13 4.13.1698292274-1.el8
  • sisu RHEL 8, RHEL 8.4 EUS, RHEL 8.2 EUS +1 more 1:0.3.3-6.module+el8+2452+b359bfcd
  • jansi RHEL 8, RHEL 8.4 EUS, RHEL 8.2 EUS +1 more 1.17.1-1.module+el8+2452+b359bfcd
  • jsoup RHEL 8, RHEL 8.4 EUS, RHEL 8.2 EUS +1 more 1.11.3-3.module+el8+2452+b359bfcd
  • maven RHEL 8, RHEL 8.4 EUS, RHEL 8.2 EUS +1 more 1:3.5.4-5.module+el8+2452+b359bfcd
  • slf4j RHEL 8, RHEL 8.4 EUS, RHEL 8.2 EUS +1 more 1.7.25-4.module+el8+2452+b359bfcd
  • cdi-api RHEL 8, RHEL 8.4 EUS, RHEL 8.2 EUS +1 more 1.2-8.module+el8+2452+b359bfcd

red hat advisories RHSA-2023:6179RHSA-2022:4798RHSA-2022:4797RHSA-2022:4699RHSA-2024:0777RHSA-2023:6172

  • sisu AlmaLinux 8 0.3.4-2.module_el8.6.0+2786+d7c38b21
  • guava AlmaLinux 8 28.1-3.module_el8.6.0+2786+d7c38b21
  • jansi AlmaLinux 8 1.18-4.module_el8.6.0+2786+d7c38b21
  • jsoup AlmaLinux 8 1.12.1-3.module_el8.6.0+2786+d7c38b21
  • maven AlmaLinux 8 1:3.6.2-7.module_el8.6.0+2786+d7c38b21
  • slf4j AlmaLinux 8 1.7.28-3.module_el8.6.0+2786+d7c38b21
  • cdi-api AlmaLinux 8 2.0.1-3.module_el8.6.0+2786+d7c38b21
  • jsr-305 AlmaLinux 8 0-0.25.20130910svn.module_el8.6.0+2786+d7c38b21

almalinux advisories ALSA-2022:4797ALSA-2022:4798

  • sisu Rocky Linux 8 0.3.4-2.module+el8.6.0+844+4401f2ed
  • sisu Rocky Linux 8 0.3.4-2.module+el8.3.0+134+f7791fe0
  • guava Rocky Linux 8 28.1-3.module+el8.6.0+844+4401f2ed
  • guava Rocky Linux 8 28.1-3.module+el8.3.0+134+f7791fe0
  • jansi Rocky Linux 8 1.18-4.module+el8.6.0+844+4401f2ed
  • jansi Rocky Linux 8 1.18-4.module+el8.3.0+134+f7791fe0
  • jsoup Rocky Linux 8 1.12.1-3.module+el8.6.0+844+4401f2ed
  • jsoup Rocky Linux 8 1.12.1-3.module+el8.3.0+134+f7791fe0

rocky linux advisories RLSA-2022:4797RLSA-2022:4798

  • maven Arch Linux 3.3.3-1

arch linux advisories AVG-2736

Is CVE-2022-29599 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-29599 updated cvss 9.8

maven-shared-utils: Command injection via Commandline class

  • Red Hat Integration Data Virtualisation Operator maven-shared-utils Red Hat Integration Service Registry maven-shared-utils Red Hat JBoss Data Grid 7 maven-shared-utils Red Hat JBoss Enterprise Application Platform 6 maven-shared-utils Red Hat JBoss Fuse 6 maven-shared-utils Red Hat JBoss Fuse Service Works 6 maven-shared-utils
    +1 more products
    Red Hat JBoss Web Server 3 maven-shared-utils
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8 jenkins-2-plugins 4.11.1683009941-1.el8, jenkins-2-plugins 4.11.1698299029-1.el8, jenkins-2-plugins 4.11.1706516946-1.el8
    fixed: vendor fix RHSA-2023:3198
  • Red Hat OpenShift Developer Tools and Services for OCP 4.12 jenkins-2-plugins 4.12.1686649756-1.el8, jenkins-2-plugins 4.12.1698294000-1.el8, jenkins-2-plugins 4.12.1706515741-1.el8
    fixed: vendor fix RHSA-2023:3610
  • Red Hat OpenShift Developer Tools and Services for OCP 4.13 jenkins-2-plugins 4.13.1686680473-1.el8, jenkins-2-plugins 4.13.1698292274-1.el8, jenkins-2-plugins 4.13.1706516346-1.el8
    fixed: vendor fix RHSA-2023:3622
  • Red Hat OpenShift Developer Tools and Services for OCP 4.14 jenkins-2-plugins 4.14.1699356715-1.el8, jenkins-2-plugins 4.14.1706516441-1.el8
    fixed: vendor fix RHSA-2023:7288
  • Red Hat Enterprise Linux AppStream (v. 8) sisu 0.3.3-6.module+el8+2452+b359bfcd, cdi-api 1.2-8.module+el8+2452+b359bfcd, maven 3.5.4-5.module+el8+2452+b359bfcd, guava20 20.0-8.module+el8+2452+b359bfcd, hawtjni 1.16-2.module+el8+2452+b359bfcd, jansi 1.17.1-1.module+el8+2452+b359bfcd, +75 more
    fixed: vendor fix RHSA-2022:4798
  • Red Hat Enterprise Linux AppStream E4S (v. 8.1) sisu 0.3.3-6.module+el8+2452+b359bfcd, cdi-api 1.2-8.module+el8+2452+b359bfcd, maven 3.5.4-5.module+el8+2452+b359bfcd, guava20 20.0-8.module+el8+2452+b359bfcd, hawtjni 1.16-2.module+el8+2452+b359bfcd, jansi 1.17.1-1.module+el8+2452+b359bfcd, +42 more
    fixed: vendor fix RHSA-2022:4699
  • Red Hat Enterprise Linux AppStream EUS (v. 8.2) sisu 0.3.3-6.module+el8+2452+b359bfcd, cdi-api 1.2-8.module+el8+2452+b359bfcd, maven 3.5.4-5.module+el8+2452+b359bfcd, guava20 20.0-8.module+el8+2452+b359bfcd, hawtjni 1.16-2.module+el8+2452+b359bfcd, jansi 1.17.1-1.module+el8+2452+b359bfcd, +74 more Red Hat Enterprise Linux AppStream EUS (v.8.4) sisu 0.3.3-6.module+el8+2452+b359bfcd, cdi-api 1.2-8.module+el8+2452+b359bfcd, maven 3.5.4-5.module+el8+2452+b359bfcd, guava20 20.0-8.module+el8+2452+b359bfcd, hawtjni 1.16-2.module+el8+2452+b359bfcd, jansi 1.17.1-1.module+el8+2452+b359bfcd, +74 more
    fixed: vendor fix RHSA-2022:4798
show 5 more
  • Red Hat Enterprise Linux Client Optional (v. 7) maven-shared-utils 0.4-4.el7_9, maven-shared-utils-javadoc 0.4-4.el7_9 Red Hat Enterprise Linux ComputeNode Optional (v. 7) maven-shared-utils 0.4-4.el7_9, maven-shared-utils-javadoc 0.4-4.el7_9 Red Hat Enterprise Linux Server Optional (v. 7) maven-shared-utils 0.4-4.el7_9, maven-shared-utils-javadoc 0.4-4.el7_9 Red Hat Enterprise Linux Workstation Optional (v. 7) maven-shared-utils 0.4-4.el7_9, maven-shared-utils-javadoc 0.4-4.el7_9
    fixed: vendor fix RHSA-2022:1541
  • Red Hat OpenShift Container Platform 4.9 jenkins-2-plugins 4.9.1674644684-1.el8
    fixed: vendor fix RHSA-2023:0573
  • Red Hat OpenShift Container Platform 4.10 jenkins-2-plugins 4.10.1670851835-1.el8
    fixed: vendor fix RHSA-2022:9098
  • Red Hat Software Collections for RHEL Workstation(v. 7) rh-maven36-maven-shared-utils 3.2.1-0.2.3.el7, rh-maven36-maven-shared-utils-javadoc 3.2.1-0.2.3.el7 Red Hat Software Collections for RHEL(v. 7) rh-maven36-maven-shared-utils 3.2.1-0.2.3.el7, rh-maven36-maven-shared-utils-javadoc 3.2.1-0.2.3.el7
    fixed: vendor fix RHSA-2022:1662
  • Red Hat A-MQ Clients 2 maven-shared-utils Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/elasticsearch6-rhel8 Red Hat OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8 jenkins 2.387.1.1683009763-3.el8, jenkins 2.414.3.1698298955-3.el8, jenkins 2.426.3.1706516929-3.el8 Red Hat OpenShift Developer Tools and Services for OCP 4.12 jenkins 2.401.1.1686649641-3.el8, jenkins 2.414.3.1698293911-3.el8, jenkins 2.426.3.1706515686-3.el8 Red Hat OpenShift Developer Tools and Services for OCP 4.13 jenkins 2.401.1.1686680404-3.el8, jenkins 2.414.3.1698292201-3.el8, jenkins 2.426.3.1706516254-3.el8 Red Hat OpenShift Developer Tools and Services for OCP 4.14 jenkins 2.414.3.1699356615-3.el8, jenkins 2.426.3.1706516352-3.el8
    +11 more products
    Red Hat A-MQ Online maven-shared-utils Red Hat AMQ Broker 7 maven-shared-utils Red Hat build of Apicurio Registry 2 maven-shared-utils Red Hat build of Debezium 1 maven-shared-utils Red Hat build of Quarkus maven-shared-utils Red Hat Data Grid 8 maven-shared-utils Red Hat Decision Manager 7 maven-shared-utils Red Hat Enterprise Linux 9 maven-shared-utils, maven-shared-utils-javadoc Red Hat Fuse 7 maven-shared-utils Red Hat Integration Camel K 1 maven-shared-utils Red Hat Integration Camel Quarkus 1 maven-shared-utils
    not affected: vulnerable code not present

9 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

4.42% chance of exploitation in the next 30 days, higher than 91% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P
GitHub 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven org.apache.maven.shared:maven-shared-utils
<3.3.3
3.3.3

Affected products

  • Apache Software Foundation Apache Maven

Classification

Weakness
  • CWE-116 Improper Encoding or Escaping of Output
  • CWE-77 Improper Neutralization of Special Elements used in a Command

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.