CVE-2022-29599
CriticalAdvisory
Published 24 May 2022In the index since 8 Sept 2026
- Severity
- Critical
- worst across findings
- CVSS
- 9.8
- base score, highest
- EPSS
- 0.044
- 91st percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 20
- of 17,781 indexed, latest versions
- Container images
- 20
- deployed by those charts
- Fix available
- 28 of 28
- affected packages
Command injection in Apache Maven maven-shared-utils
Carried by container images the latest versions of 20 of 17,781 indexed charts deploy, on 20 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| maven-shared-utilsmaven | 0.7, 3.0.0, 3.1.0, 3.2.1 | 3.3.3 | 20 |
| maven-shared-utilsrpm | 3.2.1-0.4.module+el8.3.0+6804+157bd82e, 3.2.1-0.4.module+el8.6.0+13337+afcb49ec | 0:3.2.1-0.5.module+el8.4.0+15048+bdaf849b, 0:3.2.1-0.5.module+el8.6.0+15049+43453910 | 8 |
| aopalliancerpm | 1.0-20.module+el8.3.0+6804+157bd82e | 0:1.0-20.module+el8.6.0+13337+afcb49ec | 5 |
| apache-commons-clirpm | 1.4-7.module+el8.3.0+6804+157bd82e | 0:1.4-7.module+el8.6.0+13337+afcb49ec | 5 |
| apache-commons-codecrpm | 1.13-3.module+el8.3.0+6804+157bd82e | 0:1.13-3.module+el8.6.0+13337+afcb49ec | 5 |
| apache-commons-iorpm | 1:2.6-6.module+el8.3.0+6804+157bd82e | 1:2.6-6.module+el8.6.0+13337+afcb49ec | 5 |
| apache-commons-lang3rpm | 3.9-4.module+el8.3.0+6804+157bd82e | 0:3.9-4.module+el8.6.0+13337+afcb49ec | 5 |
| atinjectrpm | 1-31.20100611svn86.module+el8.3.0+6804+157bd82e | 0:1-31.20100611svn86.module+el8.6.0+13337+afcb49ec | 5 |
| cdi-apirpm | 2.0.1-3.module+el8.3.0+6804+157bd82e | 0:2.0.1-3.module+el8.6.0+13337+afcb49ec | 5 |
| geronimo-annotationrpm | 1.0-26.module+el8.3.0+6804+157bd82e | 0:1.0-26.module+el8.6.0+13337+afcb49ec | 5 |
| google-guicerpm | 4.2.2-4.module+el8.3.0+6804+157bd82e | 0:4.2.2-4.module+el8.6.0+13337+afcb49ec | 5 |
| guavarpm | 28.1-3.module+el8.3.0+6804+157bd82e | 0:28.1-3.module+el8.6.0+13337+afcb49ec | 5 |
| httpcomponents-clientrpm | 4.5.10-3.module+el8.3.0+6804+157bd82e | 0:4.5.10-4.module+el8.6.0+13337+afcb49ec | 5 |
| httpcomponents-corerpm | 4.4.12-3.module+el8.3.0+6804+157bd82e | 0:4.4.12-3.module+el8.6.0+13337+afcb49ec | 5 |
| jansirpm | 1.18-4.module+el8.3.0+6804+157bd82e | 0:1.18-4.module+el8.6.0+13337+afcb49ec | 5 |
| jsouprpm | 1.12.1-3.module+el8.3.0+6804+157bd82e | 0:1.12.1-3.module+el8.6.0+13337+afcb49ec | 5 |
| jsr-305rpm | 0-0.25.20130910svn.module+el8.3.0+6804+157bd82e | 0:0-0.25.20130910svn.module+el8.6.0+13337+afcb49ec | 5 |
| mavenrpm | 1:3.6.2-6.module+el8.4.0+9250+1786af37 | 1:3.6.2-7.module+el8.6.0+13337+afcb49ec | 5 |
| maven-resolverrpm | 1.4.1-3.module+el8.3.0+6804+157bd82e | 0:1.4.1-3.module+el8.6.0+13337+afcb49ec | 5 |
| maven-wagonrpm | 3.3.4-2.module+el8.3.0+6804+157bd82e | 0:3.3.4-2.module+el8.6.0+13337+afcb49ec | 5 |
| plexus-cipherrpm | 1.7-17.module+el8.3.0+6804+157bd82e | 0:1.7-17.module+el8.6.0+13337+afcb49ec | 5 |
| plexus-classworldsrpm | 2.6.0-4.module+el8.3.0+6804+157bd82e | 0:2.6.0-4.module+el8.6.0+13337+afcb49ec | 5 |
| plexus-containersrpm | 2.1.0-2.module+el8.3.0+6804+157bd82e | 0:2.1.0-2.module+el8.6.0+13337+afcb49ec | 5 |
| plexus-interpolationrpm | 1.26-3.module+el8.3.0+6804+157bd82e | 0:1.26-3.module+el8.6.0+13337+afcb49ec | 5 |
| plexus-sec-dispatcherrpm | 1.4-29.module+el8.3.0+6804+157bd82e | 0:1.4-29.module+el8.6.0+13337+afcb49ec | 5 |
| plexus-utilsrpm | 3.3.0-3.module+el8.3.0+6804+157bd82e | 0:3.3.0-3.module+el8.6.0+13337+afcb49ec | 5 |
| sisurpm | 0.3.4-2.module+el8.3.0+6804+157bd82e | 0:0.3.4-2.module+el8.6.0+13337+afcb49ec | 5 |
| slf4jrpm | 1.7.28-3.module+el8.3.0+6804+157bd82e | 0:1.7.28-3.module+el8.6.0+13337+afcb49ec | 5 |
- OSV records
- GHSA-rhgr-952r-6p8qRHSA-2022:4797
Charts affected
20 by stars
Container images carrying it
20 by charts deploying them
A fixed version is listed for 28 of the 28 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| stakater/ | 954d2be66e95 | maven-shared-utils | 3.3.3 | 2 |
| apicurio/ | a97d67487532 | aopalliance apache-commons-cli apache-commons-codec apache-commons-io apache-commons-lang3 atinject cdi-api geronimo-annotation google-guice guava httpcomponents-client httpcomponents-core jansi jsoup jsr-305 maven maven-resolver maven-shared-utils maven-shared-utils maven-wagon plexus-cipher plexus-classworlds plexus-containers plexus-interpolation plexus-sec-dispatcher plexus-utils sisu slf4j | 0:1.0-20.module+el8.6.0+13337+afcb49ec 0:1.4-7.module+el8.6.0+13337+afcb49ec 0:1.13-3.module+el8.6.0+13337+afcb49ec 1:2.6-6.module+el8.6.0+13337+afcb49ec 0:3.9-4.module+el8.6.0+13337+afcb49ec 0:1-31.20100611svn86.module+el8.6.0+13337+afcb49ec 0:2.0.1-3.module+el8.6.0+13337+afcb49ec 0:1.0-26.module+el8.6.0+13337+afcb49ec 0:4.2.2-4.module+el8.6.0+13337+afcb49ec 0:28.1-3.module+el8.6.0+13337+afcb49ec 0:4.5.10-4.module+el8.6.0+13337+afcb49ec 0:4.4.12-3.module+el8.6.0+13337+afcb49ec 0:1.18-4.module+el8.6.0+13337+afcb49ec 0:1.12.1-3.module+el8.6.0+13337+afcb49ec 0:0-0.25.20130910svn.module+el8.6.0+13337+afcb49ec 1:3.6.2-7.module+el8.6.0+13337+afcb49ec 0:1.4.1-3.module+el8.6.0+13337+afcb49ec 3.3.3 0:3.2.1-0.5.module+el8.4.0+15048+bdaf849b 0:3.3.4-2.module+el8.6.0+13337+afcb49ec 0:1.7-17.module+el8.6.0+13337+afcb49ec 0:2.6.0-4.module+el8.6.0+13337+afcb49ec 0:2.1.0-2.module+el8.6.0+13337+afcb49ec 0:1.26-3.module+el8.6.0+13337+afcb49ec 0:1.4-29.module+el8.6.0+13337+afcb49ec 0:3.3.0-3.module+el8.6.0+13337+afcb49ec 0:0.3.4-2.module+el8.6.0+13337+afcb49ec 0:1.7.28-3.module+el8.6.0+13337+afcb49ec | 1 |
| egdsandaru/ | 681baa1926f4 | maven-shared-utils | 3.3.3 | 1 |
| emcniece/ | 04eccbccc15c | maven-shared-utils | 3.3.3 | 1 |
| fiware/ | 92a3c5cf43c0 | maven-shared-utils maven-shared-utils | 3.3.3 0:3.2.1-0.5.module+el8.6.0+15049+43453910 | 1 |
| fiware/ | efc6793388cc | maven-shared-utils maven-shared-utils | 3.3.3 0:3.2.1-0.5.module+el8.6.0+15049+43453910 | 1 |
| flofree/ | 6b6486c5f81e | maven-shared-utils | 3.3.3 | 1 |
| folioci/ | 1513fad2b799 | maven-shared-utils | 3.3.3 | 1 |
| ibmcom/ | ab3fd1fdfa18 | maven-shared-utils | 3.3.3 | 1 |
| ibmcom/ | e17bdccc5030 | maven-shared-utils | 3.3.3 | 1 |
| krontechnology/ | 7feef7d2ab42 | maven-shared-utils | 3.3.3 | 1 |
| viniciusfcf/ | bba8ee1b5cd5 | aopalliance apache-commons-cli apache-commons-codec apache-commons-io apache-commons-lang3 atinject cdi-api geronimo-annotation google-guice guava httpcomponents-client httpcomponents-core jansi jsoup jsr-305 maven maven-resolver maven-shared-utils maven-shared-utils maven-wagon plexus-cipher plexus-classworlds plexus-containers plexus-interpolation plexus-sec-dispatcher plexus-utils sisu slf4j | 0:1.0-20.module+el8.6.0+13337+afcb49ec 0:1.4-7.module+el8.6.0+13337+afcb49ec 0:1.13-3.module+el8.6.0+13337+afcb49ec 1:2.6-6.module+el8.6.0+13337+afcb49ec 0:3.9-4.module+el8.6.0+13337+afcb49ec 0:1-31.20100611svn86.module+el8.6.0+13337+afcb49ec 0:2.0.1-3.module+el8.6.0+13337+afcb49ec 0:1.0-26.module+el8.6.0+13337+afcb49ec 0:4.2.2-4.module+el8.6.0+13337+afcb49ec 0:28.1-3.module+el8.6.0+13337+afcb49ec 0:4.5.10-4.module+el8.6.0+13337+afcb49ec 0:4.4.12-3.module+el8.6.0+13337+afcb49ec 0:1.18-4.module+el8.6.0+13337+afcb49ec 0:1.12.1-3.module+el8.6.0+13337+afcb49ec 0:0-0.25.20130910svn.module+el8.6.0+13337+afcb49ec 1:3.6.2-7.module+el8.6.0+13337+afcb49ec 0:1.4.1-3.module+el8.6.0+13337+afcb49ec 3.3.3 0:3.2.1-0.5.module+el8.6.0+15049+43453910 0:3.3.4-2.module+el8.6.0+13337+afcb49ec 0:1.7-17.module+el8.6.0+13337+afcb49ec 0:2.6.0-4.module+el8.6.0+13337+afcb49ec 0:2.1.0-2.module+el8.6.0+13337+afcb49ec 0:1.26-3.module+el8.6.0+13337+afcb49ec 0:1.4-29.module+el8.6.0+13337+afcb49ec 0:3.3.0-3.module+el8.6.0+13337+afcb49ec 0:0.3.4-2.module+el8.6.0+13337+afcb49ec 0:1.7.28-3.module+el8.6.0+13337+afcb49ec | 1 |
| quay.io/ | a3b9a07648b6 | aopalliance apache-commons-cli apache-commons-codec apache-commons-io apache-commons-lang3 atinject cdi-api geronimo-annotation google-guice guava httpcomponents-client httpcomponents-core jansi jsoup jsr-305 maven maven-resolver maven-shared-utils maven-shared-utils maven-wagon plexus-cipher plexus-classworlds plexus-containers plexus-interpolation plexus-sec-dispatcher plexus-utils sisu slf4j | 0:1.0-20.module+el8.6.0+13337+afcb49ec 0:1.4-7.module+el8.6.0+13337+afcb49ec 0:1.13-3.module+el8.6.0+13337+afcb49ec 1:2.6-6.module+el8.6.0+13337+afcb49ec 0:3.9-4.module+el8.6.0+13337+afcb49ec 0:1-31.20100611svn86.module+el8.6.0+13337+afcb49ec 0:2.0.1-3.module+el8.6.0+13337+afcb49ec 0:1.0-26.module+el8.6.0+13337+afcb49ec 0:4.2.2-4.module+el8.6.0+13337+afcb49ec 0:28.1-3.module+el8.6.0+13337+afcb49ec 0:4.5.10-4.module+el8.6.0+13337+afcb49ec 0:4.4.12-3.module+el8.6.0+13337+afcb49ec 0:1.18-4.module+el8.6.0+13337+afcb49ec 0:1.12.1-3.module+el8.6.0+13337+afcb49ec 0:0-0.25.20130910svn.module+el8.6.0+13337+afcb49ec 1:3.6.2-7.module+el8.6.0+13337+afcb49ec 0:1.4.1-3.module+el8.6.0+13337+afcb49ec 3.3.3 0:3.2.1-0.5.module+el8.4.0+15048+bdaf849b 0:3.3.4-2.module+el8.6.0+13337+afcb49ec 0:1.7-17.module+el8.6.0+13337+afcb49ec 0:2.6.0-4.module+el8.6.0+13337+afcb49ec 0:2.1.0-2.module+el8.6.0+13337+afcb49ec 0:1.26-3.module+el8.6.0+13337+afcb49ec 0:1.4-29.module+el8.6.0+13337+afcb49ec 0:3.3.0-3.module+el8.6.0+13337+afcb49ec 0:0.3.4-2.module+el8.6.0+13337+afcb49ec 0:1.7.28-3.module+el8.6.0+13337+afcb49ec | 1 |
| quay.io/ | 55330b1b60c1 | maven-shared-utils | 3.3.3 | 1 |
| quay.io/ | bb40472e4ff5 | aopalliance apache-commons-cli apache-commons-codec apache-commons-io apache-commons-lang3 atinject cdi-api geronimo-annotation google-guice guava httpcomponents-client httpcomponents-core jansi jsoup jsr-305 maven maven-resolver maven-shared-utils maven-shared-utils maven-wagon plexus-cipher plexus-classworlds plexus-containers plexus-interpolation plexus-sec-dispatcher plexus-utils sisu slf4j | 0:1.0-20.module+el8.6.0+13337+afcb49ec 0:1.4-7.module+el8.6.0+13337+afcb49ec 0:1.13-3.module+el8.6.0+13337+afcb49ec 1:2.6-6.module+el8.6.0+13337+afcb49ec 0:3.9-4.module+el8.6.0+13337+afcb49ec 0:1-31.20100611svn86.module+el8.6.0+13337+afcb49ec 0:2.0.1-3.module+el8.6.0+13337+afcb49ec 0:1.0-26.module+el8.6.0+13337+afcb49ec 0:4.2.2-4.module+el8.6.0+13337+afcb49ec 0:28.1-3.module+el8.6.0+13337+afcb49ec 0:4.5.10-4.module+el8.6.0+13337+afcb49ec 0:4.4.12-3.module+el8.6.0+13337+afcb49ec 0:1.18-4.module+el8.6.0+13337+afcb49ec 0:1.12.1-3.module+el8.6.0+13337+afcb49ec 0:0-0.25.20130910svn.module+el8.6.0+13337+afcb49ec 1:3.6.2-7.module+el8.6.0+13337+afcb49ec 0:1.4.1-3.module+el8.6.0+13337+afcb49ec 3.3.3 0:3.2.1-0.5.module+el8.6.0+15049+43453910 0:3.3.4-2.module+el8.6.0+13337+afcb49ec 0:1.7-17.module+el8.6.0+13337+afcb49ec 0:2.6.0-4.module+el8.6.0+13337+afcb49ec 0:2.1.0-2.module+el8.6.0+13337+afcb49ec 0:1.26-3.module+el8.6.0+13337+afcb49ec 0:1.4-29.module+el8.6.0+13337+afcb49ec 0:3.3.0-3.module+el8.6.0+13337+afcb49ec 0:0.3.4-2.module+el8.6.0+13337+afcb49ec 0:1.7.28-3.module+el8.6.0+13337+afcb49ec | 1 |
| quay.io/ | 0dc38a87b844 | maven-shared-utils maven-shared-utils | 3.3.3 0:3.2.1-0.5.module+el8.6.0+15049+43453910 | 1 |
| quay.io/ | a8a9ec461034 | maven-shared-utils | 3.3.3 | 1 |
| quay.io/ | e383ba3e0966 | aopalliance apache-commons-cli apache-commons-codec apache-commons-io apache-commons-lang3 atinject cdi-api geronimo-annotation google-guice guava httpcomponents-client httpcomponents-core jansi jsoup jsr-305 maven maven-resolver maven-shared-utils maven-shared-utils maven-wagon plexus-cipher plexus-classworlds plexus-containers plexus-interpolation plexus-sec-dispatcher plexus-utils sisu slf4j | 0:1.0-20.module+el8.6.0+13337+afcb49ec 0:1.4-7.module+el8.6.0+13337+afcb49ec 0:1.13-3.module+el8.6.0+13337+afcb49ec 1:2.6-6.module+el8.6.0+13337+afcb49ec 0:3.9-4.module+el8.6.0+13337+afcb49ec 0:1-31.20100611svn86.module+el8.6.0+13337+afcb49ec 0:2.0.1-3.module+el8.6.0+13337+afcb49ec 0:1.0-26.module+el8.6.0+13337+afcb49ec 0:4.2.2-4.module+el8.6.0+13337+afcb49ec 0:28.1-3.module+el8.6.0+13337+afcb49ec 0:4.5.10-4.module+el8.6.0+13337+afcb49ec 0:4.4.12-3.module+el8.6.0+13337+afcb49ec 0:1.18-4.module+el8.6.0+13337+afcb49ec 0:1.12.1-3.module+el8.6.0+13337+afcb49ec 0:0-0.25.20130910svn.module+el8.6.0+13337+afcb49ec 1:3.6.2-7.module+el8.6.0+13337+afcb49ec 0:1.4.1-3.module+el8.6.0+13337+afcb49ec 3.3.3 0:3.2.1-0.5.module+el8.6.0+15049+43453910 0:3.3.4-2.module+el8.6.0+13337+afcb49ec 0:1.7-17.module+el8.6.0+13337+afcb49ec 0:2.6.0-4.module+el8.6.0+13337+afcb49ec 0:2.1.0-2.module+el8.6.0+13337+afcb49ec 0:1.26-3.module+el8.6.0+13337+afcb49ec 0:1.4-29.module+el8.6.0+13337+afcb49ec 0:3.3.0-3.module+el8.6.0+13337+afcb49ec 0:0.3.4-2.module+el8.6.0+13337+afcb49ec 0:1.7.28-3.module+el8.6.0+13337+afcb49ec | 1 |
| quay.io/ | 6ba82beff18e | maven-shared-utils | 3.3.3 | 1 |
| quay.io/ | 8e928db29ee1 | maven-shared-utils | 3.3.3 | 1 |