Home[1] Files[2] News[3] &[SERVICES_TAB] Contact[4] Add New[5]
- Ubuntu Security Notice USN-6730-1[6]
- Authored by Ubuntu[7] | Site security.ubuntu.com[8]
-
Ubuntu Security Notice 6730-1 - It was discovered that Apache Maven Shared Utils did not handle double-quoted strings properly, allowing shell injection attacks. This could allow an attacker to run arbitrary code.
- systems | linux[9], ubuntu[10]
- advisories | CVE-2022-29599[11]
- SHA-256 |
15c8d6e5b9065ade2c2ed5b94442496e05fb18a0a38ae85a9562327745d57a90
- Download[12] | Favorite[13] | View[14]
Change Mirror[15] Download[16]
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
==========================================================================
Ubuntu Security Notice USN-6730-1
April 11, 2024
maven-shared-utils vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- - Ubuntu 22.04 LTS
- - Ubuntu 20.04 LTS
- - Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- - Ubuntu 16.04 LTS (Available with Ubuntu Pro)
- - Ubuntu 14.04 LTS (Available with Ubuntu Pro)
Summary:
maven-shared-utils could be made to run programs if it received
specially crafted input.
Software Description:
- - maven-shared-utils: A collection of Maven utility classes.
Details:
It was discovered that Apache Maven Shared Utils did not handle double-quoted
strings properly, allowing shell injection attacks. This could allow an
attacker to run arbitrary code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.04 LTS:
libmaven-shared-utils-java 3.3.0-1ubuntu0.22.04.1
Ubuntu 20.04 LTS:
libmaven-shared-utils-java 3.3.0-1ubuntu0.20.04.1
Ubuntu 18.04 LTS (Available with Ubuntu Pro):
libmaven-shared-utils-java 3.3.0-1ubuntu0.18.04.1~esm1
Ubuntu 16.04 LTS (Available with Ubuntu Pro):
libmaven-shared-utils-java 0.9-1ubuntu0.1~esm1
Ubuntu 14.04 LTS (Available with Ubuntu Pro):
libmaven-shared-utils-java 0.4-1ubuntu0.1~esm1
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6730-1
CVE-2022-29599
Package Information:
https://launchpad.net/ubuntu/+source/maven-shared-utils/3.3.0-1ubuntu0.22.04.1
https://launchpad.net/ubuntu/+source/maven-shared-utils/3.3.0-1ubuntu0.20.04.1
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEETB/nIDy9nvCSgAUj3gXQmO/Tr3wFAmYYcLwACgkQ3gXQmO/T
r3yYcRAAgdreHC0o+VtyTJL/jorqqs7vKGZv4qC0XhaP69STRNtlSR4rG4I9wRqm
BOhmBVLJylEtxfAxiWrnag5N04CBR12nr/Shk+JCm06e/5ROnu9LYiCoMowORZzy
Nnlu82qRmCwvnL9iSWzI4wnArDehMVniOCMmWNCfpa6/UXoh1gVCjikRAWRlBOAv
uA0KrR0cNwJ90G5wuB59zqxoUPZBf+AVCkjXYSv5WbWTvLrZbz8zhmKvc8kqu1OL
0D05mwH5kxXuhapZ8kBqapytjP+GmuRjHFI7kk+3yhPul2J0JDcNGO99lOZ2lUfz
IXk1S/XQTt2aEhdoanrpI6lVXcVHA0yr5I03bFEDg8D1BwZRm29KBrH2wsHdpN6J
XWIHfaHR7kYfDVsm9kpc72b7jv/aDD66vPsI/W3A/2QttpwpjwXgZSc2Mtx/WE+T
O5/b0jtpNrwHHYLigE2PYMPaRPjxtxhQ7qnd6FccNQl9+fOrKw9NHBAu0r5s4jlI
cU9d47W/mdEcM3y5OuSe8lN6rtHsvnjaQxuuO5lCLKIOpohi7YyyaU5aHGXns34P
FnImexzC8YxRvbR5ku/4ZgOAcPv9kC0wMDiC7rggqLGlhsohoca1wXG2TRIsinx5
fRFjffvqcF6bbfyjWIKKZaM4y1QmhX3+Eth77QEqLb0InJAWDp4=
=P4zw
-----END PGP SIGNATURE-----
File Tags
- ActiveX[22] (933)
- Advisory[23] (84,757)
- Arbitrary[24] (16,648)
- BBS[25] (2,859)
- Bypass[26] (1,826)
- CGI[27] (1,032)
- Code Execution[28] (7,630)
- Conference[29] (689)
- Cracker[30] (844)
- CSRF[31] (3,373)
- DoS[32] (24,538)
- Encryption[33] (2,383)
- Exploit[34] (52,797)
- File Inclusion[35] (4,251)
- File Upload[36] (986)
- Firewall[37] (822)
- Info Disclosure[38] (2,847)
- Intrusion Detection[39] (906)
- Java[40] (3,118)
- JavaScript[41] (889)
- Kernel[42] (7,007)
- Local[43] (14,711)
- Magazine[44] (586)
- Overflow[45] (13,034)
- Perl[46] (1,430)
- PHP[47] (5,197)
- Proof of Concept[48] (2,368)
- Protocol[49] (3,695)
- Python[50] (1,599)
- Remote[51] (31,406)
- Root[52] (3,618)
- Rootkit[53] (522)
- Ruby[54] (619)
- Scanner[55] (1,650)
- Security Tool[56] (7,978)
- Shell[57] (3,249)
- Shellcode[58] (1,217)
- Sniffer[59] (900)
- Spoof[60] (2,258)
- SQL Injection[61] (16,531)
- TCP[62] (2,423)
- Trojan[63] (689)
- UDP[64] (897)
- Virus[65] (668)
- Vulnerability[66] (32,574)
- Web[67] (9,867)
- Whitepaper[68] (3,773)
- x86[69] (967)
- XSS[70] (18,171)
- Other[71]
File Archives
- April 2024[72]
- March 2024[73]
- February 2024[74]
- January 2024[75]
- December 2023[76]
- November 2023[77]
- October 2023[78]
- September 2023[79]
- August 2023[80]
- July 2023[81]
- June 2023[82]
- May 2023[83]
- Older[84]
Systems
- AIX[85] (429)
- Apple[86] (2,078)
- BSD[87] (376)
- CentOS[88] (58)
- Cisco[89] (1,927)
- Debian[90] (7,004)
- Fedora[91] (1,693)
- FreeBSD[92] (1,246)
- Gentoo[93] (4,467)
- HPUX[94] (880)
- iOS[95] (373)
- iPhone[96] (108)
- IRIX[97] (220)
- Juniper[98] (69)
- Linux[99] (49,155)
- Mac OS X[100] (691)
- Mandriva[101] (3,105)
- NetBSD[102] (256)
- OpenBSD[103] (488)
- RedHat[104] (15,452)
- Slackware[105] (941)
- Solaris[106] (1,611)
- SUSE[107] (1,444)
- Ubuntu[108] (9,427)
- UNIX[109] (9,388)
- UnixWare[110] (187)
- Windows[111] (6,647)
- Other[112]
- Services
- Security Services[123]
- Hosting By
- Rokasec[124]
Read more https://packetstormsecurity.com/files/178038/USN-6730-1.txt