[SECURITY] [DLA 1237-1] plexus-utils2 security update

2018-01-0922:05:31

lists.debian.org

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.004 Low

EPSS

Percentile

73.2%

JSON

Package : plexus-utils2
Version : 2.0.5-1+deb7u1
CVE ID : CVE-2017-1000487

Charles Duffy discovered that the Commandline class in plexus-utils2, a
collection of components used by Apache Maven, does not correctly
quote the contents of double-quoted strings. An attacker may use this
flaw to inject arbitrary shell commands.

For Debian 7 "Wheezy", these problems have been fixed in version
2.0.5-1+deb7u1.

We recommend that you upgrade your plexus-utils2 packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian9alllibplexus-utils-java< 1:1.5.15-4+deb9u1libplexus-utils-java_1:1.5.15-4+deb9u1_all.deb
Debian7allplexus-utils< 1:1.5.15-4+deb7u1plexus-utils_1:1.5.15-4+deb7u1_all.deb
Debian7alllibplexus-utils-java-doc< 1:1.5.15-4+deb7u1libplexus-utils-java-doc_1:1.5.15-4+deb7u1_all.deb
Debian8alllibplexus-utils2-java-doc< 3.0.15-1+deb8u1libplexus-utils2-java-doc_3.0.15-1+deb8u1_all.deb
Debian8alllibplexus-utils-java-doc< 1:1.5.15-4+deb8u1libplexus-utils-java-doc_1:1.5.15-4+deb8u1_all.deb
Debian9allplexus-utils< 1:1.5.15-4+deb9u1plexus-utils_1:1.5.15-4+deb9u1_all.deb
Debian8allplexus-utils2< 3.0.15-1+deb8u1plexus-utils2_3.0.15-1+deb8u1_all.deb
Debian9alllibplexus-utils-java-doc< 1:1.5.15-4+deb9u1libplexus-utils-java-doc_1:1.5.15-4+deb9u1_all.deb
Debian8alllibplexus-utils2-java< 3.0.15-1+deb8u1libplexus-utils2-java_3.0.15-1+deb8u1_all.deb
Debian7allplexus-utils2< 2.0.5-1+deb7u1plexus-utils2_2.0.5-1+deb7u1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	9	all	libplexus-utils-java	< 1:1.5.15-4+deb9u1	libplexus-utils-java_1:1.5.15-4+deb9u1_all.deb
Debian	7	all	plexus-utils	< 1:1.5.15-4+deb7u1	plexus-utils_1:1.5.15-4+deb7u1_all.deb
Debian	7	all	libplexus-utils-java-doc	< 1:1.5.15-4+deb7u1	libplexus-utils-java-doc_1:1.5.15-4+deb7u1_all.deb
Debian	8	all	libplexus-utils2-java-doc	< 3.0.15-1+deb8u1	libplexus-utils2-java-doc_3.0.15-1+deb8u1_all.deb
Debian	8	all	libplexus-utils-java-doc	< 1:1.5.15-4+deb8u1	libplexus-utils-java-doc_1:1.5.15-4+deb8u1_all.deb
Debian	9	all	plexus-utils	< 1:1.5.15-4+deb9u1	plexus-utils_1:1.5.15-4+deb9u1_all.deb
Debian	8	all	plexus-utils2	< 3.0.15-1+deb8u1	plexus-utils2_3.0.15-1+deb8u1_all.deb
Debian	9	all	libplexus-utils-java-doc	< 1:1.5.15-4+deb9u1	libplexus-utils-java-doc_1:1.5.15-4+deb9u1_all.deb
Debian	8	all	libplexus-utils2-java	< 3.0.15-1+deb8u1	libplexus-utils2-java_3.0.15-1+deb8u1_all.deb
Debian	7	all	plexus-utils2	< 2.0.5-1+deb7u1	plexus-utils2_2.0.5-1+deb7u1_all.deb