Path traversal in Codehaus plexus-utils - CVE-2025-67030

Vulnerability identifier: #VU132316

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-67030

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to write arbitrary files.

The vulnerability exists due to path traversal in the extractFile function when extracting archive entries with traversal sequences or absolute paths. A remote attacker can supply a specially crafted archive to write arbitrary files.

If a written file is later used as an executable or configuration file, this may lead to code execution in the context of the current working user.

Codehaus plexus-utils
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for IBM z Systems
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support
Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support
Development Tools Module
openSUSE Leap
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
plexus-build-api
plexus-build-api-javadoc
jsr-305
jsr-305-javadoc
isorelax
isorelax-javadoc
jsch
jsch-javadoc
sisu-mojos-javadoc
sisu-mojos
sisu-plexus
sisu-javadoc
sisu-inject
maven-cal10n-plugin
cal10n
cal10n-javadoc
maven-artifact-transfer-javadoc
maven-artifact-transfer
plexus-languages
plexus-languages-javadoc
java_cup
java_cup-manual
java_cup-javadoc
jboss-interceptors-1.2-api-javadoc
jboss-interceptors-1.2-api
plexus-i18n-javadoc
plexus-i18n
plexus-component-factories-pom
plexus-bsh-factory
plexus-bsh-factory-javadoc
plexus-ant-factory-javadoc
plexus-ant-factory
plexus-resources-javadoc
plexus-resources
plexus-component-api-javadoc
plexus-component-api
plexus-interactivity-jline
plexus-interactivity
plexus-interactivity-api
plexus-interactivity-javadoc
jtidy
jtidy-javadoc
ant-contrib-javadoc
ant-contrib
munge-maven-plugin
munge-maven-plugin-javadoc
aopalliance
aopalliance-javadoc
maven-artifact-resolver-javadoc
maven-artifact-resolver
geronimo-annotation-javadoc
geronimo-annotation
maven-resolver
maven-resolver-util
maven-resolver-transport-wagon
maven-resolver-transport-http
maven-resolver-transport-file
maven-resolver-transport-classpath
maven-resolver-test-util
maven-resolver-spi
maven-resolver-javadoc
maven-resolver-impl
maven-resolver-connector-basic
maven-resolver-api
geronimo-jpa
geronimo-jpa-javadoc
geronimo-jms
geronimo-jms-javadoc
jzlib
jzlib-demo
jzlib-javadoc
jdom-javadoc
jdom-demo
jdom
jaxen-javadoc
jaxen
jaxen-demo
maven-script-interpreter
maven-script-interpreter-javadoc
glassfish-legal
maven-shared-incremental
maven-shared-incremental-javadoc
felix-osgi-foundation
felix-osgi-foundation-javadoc
jdependency
jdependency-javadoc
os-maven-plugin
os-maven-plugin-javadoc
plexus-velocity-javadoc
plexus-velocity
cdi-api
cdi-api-javadoc
spec-version-maven-plugin-javadoc
spec-version-maven-plugin
glassfish-annotation-api-javadoc
glassfish-annotation-api
apache-commons-logging-javadoc
apache-commons-logging
log4j12
log4j12-javadoc
xml-commons-resolver-javadoc
xml-commons-resolver
plexus-components-pom
apache-commons-exec
apache-commons-exec-javadoc
hamcrest-core
hamcrest-javadoc
hamcrest-demo
hamcrest
apache-commons-jxpath-javadoc
apache-commons-jxpath
felix-osgi-core-javadoc
felix-osgi-core
felix-osgi-compendium-javadoc
felix-osgi-compendium
maven-enforcer-javadoc
maven-enforcer
maven-enforcer-api
maven-enforcer-plugin
maven-enforcer-rules
xml-commons-apis-manual
xml-commons-apis-javadoc
xml-commons-apis
apache-commons-cli
apache-commons-cli-javadoc
plexus-sec-dispatcher
plexus-sec-dispatcher-javadoc
maven-remote-resources-plugin-javadoc
maven-remote-resources-plugin
javamail-javadoc
javamail
objectweb-pom
regexp-javadoc
regexp
exec-maven-plugin-javadoc
exec-maven-plugin
jflex-javadoc
jflex
powermock-core
powermock-testng
powermock-reflect
powermock-junit4
powermock-javadoc
powermock-api-support
powermock-api-mockito
powermock-api-easymock
powermock-common
maven-verifier
maven-verifier-javadoc
plexus-cli
plexus-cli-javadoc
xmlunit-javadoc
xmlunit
geronimo-parent-poms
plexus-containers-javadoc
plexus-containers-container-default
plexus-containers-component-metadata
plexus-containers-component-javadoc
plexus-containers-component-annotations
plexus-containers
maven-doxia-sitetools
maven-doxia-sitetools-javadoc
jansi-native-javadoc
jansi-native
maven-doxia-module-apt
maven-doxia
maven-doxia-core
maven-doxia-logging-api
maven-doxia-module-confluence
maven-doxia-module-docbook-simple
maven-doxia-javadoc
maven-doxia-sink-api
maven-doxia-module-fml
maven-doxia-module-latex
maven-doxia-module-rtf
maven-doxia-module-twiki
maven-doxia-tests
maven-doxia-test-docs
maven-doxia-module-xdoc
maven-doxia-module-xhtml
maven-doxia-modules
plexus-cipher-javadoc
plexus-cipher
velocity-manual
velocity
velocity-demo
velocity-javadoc
log4j-over-slf4j
jul-to-slf4j
slf4j-ext
slf4j-javadoc
slf4j
jcl-over-slf4j
slf4j-log4j12
slf4j-jcl
slf4j-manual
slf4j-sources
slf4j-jdk14
xz-java-javadoc
maven-dependency-analyzer-javadoc
maven-dependency-analyzer
xz-java
maven-antrun-plugin
maven-antrun-plugin-javadoc
modello-javadoc
modello
maven-plugin-build-helper-javadoc
maven-plugin-build-helper
apache-commons-beanutils-javadoc
apache-commons-beanutils
felix-utils
felix-utils-javadoc
ant-swing
ant-manual
ant-testutil
ant-lib
ant-junit
ant-xz
ant-jsch
ant-jmf
ant-jdepend
ant-antlr
ant
ant-javadoc
ant-apache-bcel
ant-apache-bsf
ant-apache-log4j
ant-apache-oro
ant-apache-regexp
ant-apache-resolver
ant-apache-xalan2
ant-commons-logging
ant-commons-net
ant-javamail
maven-invoker-plugin-javadoc
maven-invoker-plugin
mockito
mockito-javadoc
fusesource-pom
apache-commons-codec
apache-commons-codec-javadoc
jsoup-javadoc
jsoup
byaccj
maven-hawtjni-plugin
hawtjni
hawtjni-javadoc
hawtjni-runtime
jansi-javadoc
jansi
apache-commons-compress-javadoc
apache-commons-compress
plexus-interpolation
plexus-interpolation-javadoc
atinject
atinject-javadoc
atinject-tck
beust-jcommander
beust-jcommander-javadoc
qdox
qdox-javadoc
jdom2
jdom2-javadoc
jakarta-oro-javadoc
jakarta-oro
bsh-manual
bsh-javadoc
bsh
maven-toolchain
maven-settings
maven-plugin-descriptor
maven-plugin-registry
maven-profile
maven-project
maven2-javadoc
maven-monitor
maven-model
maven-artifact
maven-artifact-manager
maven-invoker-javadoc
maven-invoker
glassfish-jsp-api
glassfish-jsp-api-javadoc
apache-ivy
apache-ivy-javadoc
bsf-javadoc
bsf
maven-install-plugin-javadoc
maven-install-plugin
plexus-classworlds
plexus-classworlds-javadoc
objenesis
objenesis-javadoc
apache-commons-io-javadoc
apache-commons-io
apache-commons-lang-javadoc
apache-commons-lang
javacc-maven-plugin-javadoc
javacc-maven-plugin
xalan-j2
xalan-j2-demo
xalan-j2-javadoc
xalan-j2-manual
xalan-j2-xsltc
antlr-C++
antlr-tool
antlr-manual
antlr-javadoc
plexus-compiler
plexus-compiler-extras
plexus-compiler-javadoc
plexus-compiler-pom
jdepend
jdepend-javadoc
jdepend-demo
xerces-j2-javadoc
xerces-j2-demo
xerces-j2
jline-javadoc
jline
apache-resource-bundles
maven-failsafe-plugin
maven-surefire
maven-surefire-javadoc
maven-surefire-plugin
maven-surefire-provider-junit
maven-surefire-provider-testng
maven-surefire-report-parser
maven-surefire-report-plugin
plexus-io
plexus-io-javadoc
maven-reporting-impl
maven-reporting-impl-javadoc
maven-shared-io-javadoc
maven-shared-io
maven-file-management
maven-clean-plugin
maven-clean-plugin-javadoc
maven-file-management-javadoc
xmvn-javadoc
xmvn-tools-pom
xmvn-subst
xmvn-mojo
xmvn-resolve
xmvn-parent-pom
xmvn-bisect
xmvn-minimal
xmvn-install
xmvn-core
xmvn-connector-ivy
xmvn-connector-aether
xmvn
xmvn-api
glassfish-el-javadoc
glassfish-el
glassfish-el-api
maven-common-artifact-filters
maven-common-artifact-filters-javadoc
maven-source-plugin
maven-source-plugin-javadoc
maven-dependency-plugin
maven-dependency-plugin-javadoc
maven-dependency-tree
maven-dependency-tree-javadoc
maven-reporting-api
maven-reporting-api-javadoc
maven-wagon-http-lightweight
maven-jar-plugin
maven-jar-plugin-javadoc
maven-wagon-providers
maven-wagon-provider-api
maven-wagon-javadoc
maven-wagon-http-shared
maven-wagon-http
maven-wagon-ftp
maven-wagon-file
maven-wagon
maven-shade-plugin
maven-shade-plugin-javadoc
maven-resources-plugin
maven-assembly-plugin
maven-assembly-plugin-javadoc
maven-resources-plugin-javadoc
plexus-utils-javadoc
plexus-utils
glassfish-servlet-api
glassfish-servlet-api-javadoc
maven-filtering-javadoc
maven-filtering
jakarta-commons-httpclient
jakarta-commons-httpclient-demo
jakarta-commons-httpclient-javadoc
jakarta-commons-httpclient-manual
maven-archiver
maven-archiver-javadoc
maven-shared-utils-javadoc
maven-shared-utils
apache-commons-collections
apache-commons-collections-testframework
apache-commons-collections-javadoc
cglib-javadoc
cglib
plexus-utils (Red Hat package)
maven-plugin-testing-tools
maven-test-tools
maven-plugin-testing-javadoc
maven-plugin-testing-harness
maven-plugin-testing
maven-plugin-bundle-javadoc
maven-plugin-bundle
aqute-bnd-javadoc
aqute-bndlib
bnd-maven-plugin
aqute-bnd
maven-plugin-tools-generators
maven-script-ant
maven-script-beanshell
maven-plugin-tools-beanshell
maven-plugin-tools-model
maven-plugin-tools-javadocs
maven-plugin-tools-java
maven-plugin-tools-api
maven-script
maven-plugin-tools-ant
maven-plugin-tools-javadoc
maven-plugin-tools-annotations
maven-plugin-tools
maven-plugin-annotations
maven-plugin-plugin
easymock-javadoc
easymock
maven-javadoc
maven-lib
maven
plexus-archiver-javadoc
plexus-archiver
apache-commons-net
apache-commons-net-javadoc
maven-compiler-plugin-javadoc
maven-compiler-plugin
apache-commons-lang3-javadoc
apache-commons-lang3
assertj-core
assertj-core-javadoc
javassist
javassist-javadoc
google-guice
guice-assistedinject
guice-bom
guice-extensions
guice-grapher
guice-jmx
guice-jndi
guice-multibindings
guice-parent
guice-servlet
guice-testlib
guice-throwingproviders
google-guice-javadoc
httpcomponents-core
httpcomponents-core-javadoc
felix-parent
httpcomponents-client
httpcomponents-client-cache
httpcomponents-client-javadoc
xbean-javadoc
xbean
jvnet-parent
junit-manual
junit-javadoc
junit
plexus-pom
javapackages-filesystem
python3-javapackages
maven-local
javapackages-tools
javapackages-local
ivy-local
osgi-compendium-javadoc
osgi-compendium
osgi-core-javadoc
osgi-core
osgi-annotation-javadoc
osgi-annotation
bcel-javadoc
bcel
objectweb-asm
objectweb-asm-javadoc
testng
testng-javadoc
javacc-manual
javacc-javadoc
javacc-demo
javacc
sonatype-oss-parent
glassfish-master-pom
sonatype-plugins-parent
httpcomponents-project
apache-parent
guava20-testlib
guava20-javadoc
guava20
jboss-parent
maven-shared
spice-parent
maven-parent
maven-plugins-pom
weld-parent
forge-parent
mojo-parent
apache-commons-parent
Rational Developer for i
MongoDB Enterprise Advanced with IBM
Bamboo Data Center
Red Hat Integration Camel Extensions for Quarkus

Install security update from vendor's website.

Codehaus plexus-utils - addressed in versions 3.6.1, 4.0.3
Rational Developer for i - update to 9.9.0.4
Bamboo Data Center - addressed in versions 10.2.19, 12.1.7
Red Hat Integration Camel Extensions for Quarkus - addressed in versions p, 3.33.2
plexus-build-api - update to 0.0.7-20
plexus-build-api-javadoc - update to 0.0.7-20
jsr-305 - update to 0-0.22.20130910svn
jsr-305-javadoc - update to 0-0.22.20130910svn
isorelax - update to 0-0.23.release20050331
isorelax-javadoc - update to 0-0.23.release20050331
jsch - update to 0.1.54-6
jsch-javadoc - update to 0.1.54-6
sisu-mojos-javadoc - update to 0.3.1-8
sisu-mojos - update to 0.3.1-8
sisu-plexus - update to 0.3.3-7
sisu-javadoc - update to 0.3.3-7
sisu-inject - update to 0.3.3-7
maven-cal10n-plugin - update to 0.8.1-7
cal10n - update to 0.8.1-7
cal10n-javadoc - update to 0.8.1-7
maven-artifact-transfer-javadoc - update to 0.9.0-4
maven-artifact-transfer - update to 0.9.0-4
plexus-languages - update to 0.9.10-3
plexus-languages-javadoc - update to 0.9.10-3
java_cup - update to 0.11b-8
java_cup-manual - update to 0.11b-8
java_cup-javadoc - update to 0.11b-8
jboss-interceptors-1.2-api-javadoc - update to 1.0.0-8
jboss-interceptors-1.2-api - update to 1.0.0-8
plexus-i18n-javadoc - update to 1.0-0.11.b10.4
plexus-i18n - update to 1.0-0.11.b10.4
plexus-component-factories-pom - update to 1.0-0.15.alpha11
plexus-bsh-factory - update to 1.0-0.19.a7
plexus-bsh-factory-javadoc - update to 1.0-0.19.a7
plexus-ant-factory-javadoc - update to 1.0-0.20.a2.2
plexus-ant-factory - update to 1.0-0.20.a2.2
plexus-resources-javadoc - update to 1.0-0.23.a7
plexus-resources - update to 1.0-0.23.a7
plexus-component-api-javadoc - update to 1.0-0.24.alpha15
plexus-component-api - update to 1.0-0.24.alpha15
plexus-interactivity-jline - update to 1.0-0.27.alpha6
plexus-interactivity - update to 1.0-0.27.alpha6
plexus-interactivity-api - update to 1.0-0.27.alpha6
plexus-interactivity-javadoc - update to 1.0-0.27.alpha6
jtidy - update to 1.0-0.28.20100930svn1125
jtidy-javadoc - update to 1.0-0.28.20100930svn1125
ant-contrib-javadoc - update to 1.0-0.32.b3
ant-contrib - update to 1.0-0.32.b3
munge-maven-plugin - update to 1.0-11
munge-maven-plugin-javadoc - update to 1.0-11
aopalliance - update to 1.0-17
aopalliance-javadoc - update to 1.0-17
maven-artifact-resolver-javadoc - update to 1.0-18
maven-artifact-resolver - update to 1.0-18
geronimo-annotation-javadoc - update to 1.0-23
geronimo-annotation - update to 1.0-23
maven-resolver - update to 1.1.1-2
maven-resolver-util - update to 1.1.1-2
maven-resolver-transport-wagon - update to 1.1.1-2
maven-resolver-transport-http - update to 1.1.1-2
maven-resolver-transport-file - update to 1.1.1-2
maven-resolver-transport-classpath - update to 1.1.1-2
maven-resolver-test-util - update to 1.1.1-2
maven-resolver-spi - update to 1.1.1-2
maven-resolver-javadoc - update to 1.1.1-2
maven-resolver-impl - update to 1.1.1-2
maven-resolver-connector-basic - update to 1.1.1-2
maven-resolver-api - update to 1.1.1-2
geronimo-jpa - update to 1.1.1-21
geronimo-jpa-javadoc - update to 1.1.1-21
geronimo-jms - update to 1.1.1-25
geronimo-jms-javadoc - update to 1.1.1-25
jzlib - update to 1.1.3-8
jzlib-demo - update to 1.1.3-8
jzlib-javadoc - update to 1.1.3-8
jdom-javadoc - update to 1.1.3-17
jdom-demo - update to 1.1.3-17
jdom - update to 1.1.3-17
jaxen-javadoc - update to 1.1.6-18
jaxen - update to 1.1.6-18
jaxen-demo - update to 1.1.6-18
maven-script-interpreter - update to 1.1-11
maven-script-interpreter-javadoc - update to 1.1-11
glassfish-legal - update to 1.1-11
maven-shared-incremental - update to 1.1-14
maven-shared-incremental-javadoc - update to 1.1-14
felix-osgi-foundation - update to 1.2.0-23
felix-osgi-foundation-javadoc - update to 1.2.0-23
jdependency - update to 1.2-2
jdependency-javadoc - update to 1.2-2
os-maven-plugin - update to 1.2.3-9
os-maven-plugin-javadoc - update to 1.2.3-9
plexus-velocity-javadoc - update to 1.2-4
plexus-velocity - update to 1.2-4
cdi-api - update to 1.2-8
cdi-api-javadoc - update to 1.2-8
spec-version-maven-plugin-javadoc - update to 1.2-11
spec-version-maven-plugin - update to 1.2-11
glassfish-annotation-api-javadoc - update to 1.2-13
glassfish-annotation-api - update to 1.2-13
apache-commons-logging-javadoc - update to 1.2-13
apache-commons-logging - update to 1.2-13
log4j12 - update to 1.2.17-22
log4j12-javadoc - update to 1.2.17-22
xml-commons-resolver-javadoc - update to 1.2-26
xml-commons-resolver - update to 1.2-26
plexus-components-pom - update to 1.3.1-10
apache-commons-exec - update to 1.3-8.0.1
apache-commons-exec-javadoc - update to 1.3-8.0.1
hamcrest-core - update to 1.3-23
hamcrest-javadoc - update to 1.3-23
hamcrest-demo - update to 1.3-23
hamcrest - update to 1.3-23
apache-commons-jxpath-javadoc - update to 1.3-29
apache-commons-jxpath - update to 1.3-29
felix-osgi-core-javadoc - update to 1.4.0-23
felix-osgi-core - update to 1.4.0-23
felix-osgi-compendium-javadoc - update to 1.4.0-26
felix-osgi-compendium - update to 1.4.0-26
maven-enforcer-javadoc - update to 1.4.1-8
maven-enforcer - update to 1.4.1-8
maven-enforcer-api - update to 1.4.1-8
maven-enforcer-plugin - update to 1.4.1-8
maven-enforcer-rules - update to 1.4.1-8
xml-commons-apis-manual - update to 1.4.01-25
xml-commons-apis-javadoc - update to 1.4.01-25
xml-commons-apis - update to 1.4.01-25
apache-commons-cli - update to 1.4-4
apache-commons-cli-javadoc - update to 1.4-4
plexus-sec-dispatcher - update to 1.4-26
plexus-sec-dispatcher-javadoc - update to 1.4-26
maven-remote-resources-plugin-javadoc - update to 1.5-2
maven-remote-resources-plugin - update to 1.5-2
javamail-javadoc - update to 1.5.2-7
javamail - update to 1.5.2-7
objectweb-pom - update to 1.5-7
regexp-javadoc - update to 1.5-26
regexp - update to 1.5-26
exec-maven-plugin-javadoc - update to 1.6.0-3
exec-maven-plugin - update to 1.6.0-3
jflex-javadoc - update to 1.6.1-12
jflex - update to 1.6.1-12
powermock-core - update to 1.6.5-9
powermock-testng - update to 1.6.5-9
powermock-reflect - update to 1.6.5-9
powermock-junit4 - update to 1.6.5-9
powermock-javadoc - update to 1.6.5-9
powermock-api-support - update to 1.6.5-9
powermock-api-mockito - update to 1.6.5-9
powermock-api-easymock - update to 1.6.5-9
powermock-common - update to 1.6.5-9
maven-verifier - update to 1.6-6
maven-verifier-javadoc - update to 1.6-6
plexus-cli - update to 1.6-6
plexus-cli-javadoc - update to 1.6-6
xmlunit-javadoc - update to 1.6-7
xmlunit - update to 1.6-7
geronimo-parent-poms - update to 1.6-25
plexus-containers-javadoc - update to 1.7.1-8
plexus-containers-container-default - update to 1.7.1-8
plexus-containers-component-metadata - update to 1.7.1-8
plexus-containers-component-javadoc - update to 1.7.1-8
plexus-containers-component-annotations - update to 1.7.1-8
plexus-containers - update to 1.7.1-8
maven-doxia-sitetools - update to 1.7.5-2
maven-doxia-sitetools-javadoc - update to 1.7.5-2
jansi-native-javadoc - update to 1.7-7
jansi-native - update to 1.7-7
maven-doxia-module-apt - update to 1.7-8
maven-doxia - update to 1.7-8
maven-doxia-core - update to 1.7-8
maven-doxia-logging-api - update to 1.7-8
maven-doxia-module-confluence - update to 1.7-8
maven-doxia-module-docbook-simple - update to 1.7-8
maven-doxia-javadoc - update to 1.7-8
maven-doxia-sink-api - update to 1.7-8
maven-doxia-module-fml - update to 1.7-8
maven-doxia-module-latex - update to 1.7-8
maven-doxia-module-rtf - update to 1.7-8
maven-doxia-module-twiki - update to 1.7-8
maven-doxia-tests - update to 1.7-8
maven-doxia-test-docs - update to 1.7-8
maven-doxia-module-xdoc - update to 1.7-8
maven-doxia-module-xhtml - update to 1.7-8
maven-doxia-modules - update to 1.7-8
plexus-cipher-javadoc - update to 1.7-14
plexus-cipher - update to 1.7-14
velocity-manual - update to 1.7-24
velocity - update to 1.7-24
velocity-demo - update to 1.7-24
velocity-javadoc - update to 1.7-24
log4j-over-slf4j - update to 1.7.25-4
jul-to-slf4j - update to 1.7.25-4
slf4j-ext - update to 1.7.25-4
slf4j-javadoc - update to 1.7.25-4
slf4j - update to 1.7.25-4
jcl-over-slf4j - update to 1.7.25-4
slf4j-log4j12 - update to 1.7.25-4
slf4j-jcl - update to 1.7.25-4
slf4j-manual - update to 1.7.25-4
slf4j-sources - update to 1.7.25-4
slf4j-jdk14 - update to 1.7.25-4
xz-java-javadoc - update to 1.8-2
maven-dependency-analyzer-javadoc - update to 1.8-2
maven-dependency-analyzer - update to 1.8-2
xz-java - update to 1.8-2
maven-antrun-plugin - update to 1.8-6
maven-antrun-plugin-javadoc - update to 1.8-6
modello-javadoc - update to 1.9.1-7
modello - update to 1.9.1-7
maven-plugin-build-helper-javadoc - update to 1.9.1-8
maven-plugin-build-helper - update to 1.9.1-8
apache-commons-beanutils-javadoc - update to 1.9.3-5
apache-commons-beanutils - update to 1.9.3-5
felix-utils - update to 1.10.4-2
felix-utils-javadoc - update to 1.10.4-2
ant-swing - update to 1.10.5-1
ant-manual - update to 1.10.5-1
ant-testutil - update to 1.10.5-1
ant-lib - update to 1.10.5-1
ant-junit - update to 1.10.5-1
ant-xz - update to 1.10.5-1
ant-jsch - update to 1.10.5-1
ant-jmf - update to 1.10.5-1
ant-jdepend - update to 1.10.5-1
ant-antlr - update to 1.10.5-1
ant - update to 1.10.5-1
ant-javadoc - update to 1.10.5-1
ant-apache-bcel - update to 1.10.5-1
ant-apache-bsf - update to 1.10.5-1
ant-apache-log4j - update to 1.10.5-1
ant-apache-oro - update to 1.10.5-1
ant-apache-regexp - update to 1.10.5-1
ant-apache-resolver - update to 1.10.5-1
ant-apache-xalan2 - update to 1.10.5-1
ant-commons-logging - update to 1.10.5-1
ant-commons-net - update to 1.10.5-1
ant-javamail - update to 1.10.5-1
maven-invoker-plugin-javadoc - update to 1.10-7
maven-invoker-plugin - update to 1.10-7
mockito - update to 1.10.19-17
mockito-javadoc - update to 1.10.19-17
fusesource-pom - update to 1.11-3
apache-commons-codec - update to 1.11-3
apache-commons-codec-javadoc - update to 1.11-3
jsoup-javadoc - update to 1.11.3-3
jsoup - update to 1.11.3-3
byaccj - update to 1.15-17
MongoDB Enterprise Advanced with IBM - update to 1.16.0
maven-hawtjni-plugin - update to 1.16-2
hawtjni - update to 1.16-2
hawtjni-javadoc - update to 1.16-2
hawtjni-runtime - update to 1.16-2
jansi-javadoc - update to 1.17.1-1
jansi - update to 1.17.1-1
apache-commons-compress-javadoc - update to 1.18-1
apache-commons-compress - update to 1.18-1
plexus-interpolation - update to 1.22-9
plexus-interpolation-javadoc - update to 1.22-9
atinject - update to 1-28.20100611svn86
atinject-javadoc - update to 1-28.20100611svn86
atinject-tck - update to 1-28.20100611svn86
beust-jcommander - update to 1.71-5
beust-jcommander-javadoc - update to 1.71-5
qdox - update to 2.0-3.M9
qdox-javadoc - update to 2.0-3.M9
jdom2 - update to 2.0.6-12
jdom2-javadoc - update to 2.0.6-12
jakarta-oro-javadoc - update to 2.0.8-23
jakarta-oro - update to 2.0.8-23
bsh-manual - update to 2.0-13.b6
bsh-javadoc - update to 2.0-13.b6
bsh - update to 2.0-13.b6
maven-toolchain - update to 2.2.1-59
maven-settings - update to 2.2.1-59
maven-plugin-descriptor - update to 2.2.1-59
maven-plugin-registry - update to 2.2.1-59
maven-profile - update to 2.2.1-59
maven-project - update to 2.2.1-59
maven2-javadoc - update to 2.2.1-59
maven-monitor - update to 2.2.1-59
maven-model - update to 2.2.1-59
maven-artifact - update to 2.2.1-59
maven-artifact-manager - update to 2.2.1-59
maven-invoker-javadoc - update to 2.2-7
maven-invoker - update to 2.2-7
glassfish-jsp-api - update to 2.3.2-0.9.b01
glassfish-jsp-api-javadoc - update to 2.3.2-0.9.b01
apache-ivy - update to 2.4.0-14
apache-ivy-javadoc - update to 2.4.0-14
bsf-javadoc - update to 2.4.0-30
bsf - update to 2.4.0-30
maven-install-plugin-javadoc - update to 2.5.2-7
maven-install-plugin - update to 2.5.2-7
plexus-classworlds - update to 2.5.2-9
plexus-classworlds-javadoc - update to 2.5.2-9
objenesis - update to 2.6-2
objenesis-javadoc - update to 2.6-2
apache-commons-io-javadoc - update to 2.6-3
apache-commons-io - update to 2.6-3
apache-commons-lang-javadoc - update to 2.6-21
apache-commons-lang - update to 2.6-21
javacc-maven-plugin-javadoc - update to 2.6-25
javacc-maven-plugin - update to 2.6-25
xalan-j2 - update to 2.7.1-38
xalan-j2-demo - update to 2.7.1-38
xalan-j2-javadoc - update to 2.7.1-38
xalan-j2-manual - update to 2.7.1-38
xalan-j2-xsltc - update to 2.7.1-38
antlr-C++ - update to 2.7.7-56
antlr-tool - update to 2.7.7-56
antlr-manual - update to 2.7.7-56
antlr-javadoc - update to 2.7.7-56
plexus-compiler - update to 2.8.2-2
plexus-compiler-extras - update to 2.8.2-2
plexus-compiler-javadoc - update to 2.8.2-2
plexus-compiler-pom - update to 2.8.2-2
jdepend - update to 2.9.1-18
jdepend-javadoc - update to 2.9.1-18
jdepend-demo - update to 2.9.1-18
xerces-j2-javadoc - update to 2.11.0-34
xerces-j2-demo - update to 2.11.0-34
xerces-j2 - update to 2.11.0-34
jline-javadoc - update to 2.14.6-2
jline - update to 2.14.6-2
apache-resource-bundles - update to 2-20
maven-failsafe-plugin - update to 2.22.0-3
maven-surefire - update to 2.22.0-3
maven-surefire-javadoc - update to 2.22.0-3
maven-surefire-plugin - update to 2.22.0-3
maven-surefire-provider-junit - update to 2.22.0-3
maven-surefire-provider-testng - update to 2.22.0-3
maven-surefire-report-parser - update to 2.22.0-3
maven-surefire-report-plugin - update to 2.22.0-3
plexus-io - update to 3.0.0-2
plexus-io-javadoc - update to 3.0.0-2
maven-reporting-impl - update to 3.0.0-4
maven-reporting-impl-javadoc - update to 3.0.0-4
maven-shared-io-javadoc - update to 3.0.0-5
maven-shared-io - update to 3.0.0-5
maven-file-management - update to 3.0.0-5
maven-clean-plugin - update to 3.0.0-5
maven-clean-plugin-javadoc - update to 3.0.0-5
maven-file-management-javadoc - update to 3.0.0-5
xmvn-javadoc - update to 3.0.0-21
xmvn-tools-pom - update to 3.0.0-21
xmvn-subst - update to 3.0.0-21
xmvn-mojo - update to 3.0.0-21
xmvn-resolve - update to 3.0.0-21
xmvn-parent-pom - update to 3.0.0-21
xmvn-bisect - update to 3.0.0-21
xmvn-minimal - update to 3.0.0-21
xmvn-install - update to 3.0.0-21
xmvn-core - update to 3.0.0-21
xmvn-connector-ivy - update to 3.0.0-21
xmvn-connector-aether - update to 3.0.0-21
xmvn - update to 3.0.0-21
xmvn-api - update to 3.0.0-21
glassfish-el-javadoc - update to 3.0.1-0.7.b08
glassfish-el - update to 3.0.1-0.7.b08
glassfish-el-api - update to 3.0.1-0.7.b08
maven-common-artifact-filters - update to 3.0.1-4
maven-common-artifact-filters-javadoc - update to 3.0.1-4
maven-source-plugin - update to 3.0.1-4
maven-source-plugin-javadoc - update to 3.0.1-4
maven-dependency-plugin - update to 3.0.2-2
maven-dependency-plugin-javadoc - update to 3.0.2-2
maven-dependency-tree - update to 3.0-5
maven-dependency-tree-javadoc - update to 3.0-5
maven-reporting-api - update to 3.0-14
maven-reporting-api-javadoc - update to 3.0-14
maven-wagon-http-lightweight - update to 3.1.0-1
maven-jar-plugin - update to 3.1.0-1
maven-jar-plugin-javadoc - update to 3.1.0-1
maven-wagon-providers - update to 3.1.0-1
maven-wagon-provider-api - update to 3.1.0-1
maven-wagon-javadoc - update to 3.1.0-1
maven-wagon-http-shared - update to 3.1.0-1
maven-wagon-http - update to 3.1.0-1
maven-wagon-ftp - update to 3.1.0-1
maven-wagon-file - update to 3.1.0-1
maven-wagon - update to 3.1.0-1
maven-shade-plugin - update to 3.1.0-3
maven-shade-plugin-javadoc - update to 3.1.0-3
maven-resources-plugin - update to 3.1.0-3
maven-assembly-plugin - update to 3.1.0-3
maven-assembly-plugin-javadoc - update to 3.1.0-3
maven-resources-plugin-javadoc - update to 3.1.0-3
plexus-utils-javadoc - addressed in versions 3.1.0-3.0.1, 3.4.2-2
plexus-utils - addressed in versions 3.1.0-3.0.1, 3.4.2-2
glassfish-servlet-api - update to 3.1.0-14
glassfish-servlet-api-javadoc - update to 3.1.0-14
maven-filtering-javadoc - update to 3.1.1-5
maven-filtering - update to 3.1.1-5
jakarta-commons-httpclient - update to 3.1-28
jakarta-commons-httpclient-demo - update to 3.1-28
jakarta-commons-httpclient-javadoc - update to 3.1-28
jakarta-commons-httpclient-manual - update to 3.1-28
maven-archiver - update to 3.2.0-2
maven-archiver-javadoc - update to 3.2.0-2
maven-shared-utils-javadoc - update to 3.2.1-0.1
maven-shared-utils - update to 3.2.1-0.1
apache-commons-collections - update to 3.2.2-10
apache-commons-collections-testframework - update to 3.2.2-10
apache-commons-collections-javadoc - update to 3.2.2-10
cglib-javadoc - update to 3.2.4-7
cglib - update to 3.2.4-7
plexus-utils (Red Hat package) - addressed in versions 3.3.0-10.el9_2.2, 3.3.0-10.el9_4.2, 3.3.0-13.el9_6.1, 3.5.1-8.el10_0.1, 3.5.1-9.el10_2
maven-plugin-testing-tools - update to 3.3.0-12
maven-test-tools - update to 3.3.0-12
maven-plugin-testing-javadoc - update to 3.3.0-12
maven-plugin-testing-harness - update to 3.3.0-12
maven-plugin-testing - update to 3.3.0-12
maven-plugin-bundle-javadoc - update to 3.5.0-2
maven-plugin-bundle - update to 3.5.0-2
aqute-bnd-javadoc - update to 3.5.0-4
aqute-bndlib - update to 3.5.0-4
bnd-maven-plugin - update to 3.5.0-4
aqute-bnd - update to 3.5.0-4
maven-plugin-tools-generators - update to 3.5.1-4
maven-script-ant - update to 3.5.1-4
maven-script-beanshell - update to 3.5.1-4
maven-plugin-tools-beanshell - update to 3.5.1-4
maven-plugin-tools-model - update to 3.5.1-4
maven-plugin-tools-javadocs - update to 3.5.1-4
maven-plugin-tools-java - update to 3.5.1-4
maven-plugin-tools-api - update to 3.5.1-4
maven-script - update to 3.5.1-4
maven-plugin-tools-ant - update to 3.5.1-4
maven-plugin-tools-javadoc - update to 3.5.1-4
maven-plugin-tools-annotations - update to 3.5.1-4
maven-plugin-tools - update to 3.5.1-4
maven-plugin-annotations - update to 3.5.1-4
maven-plugin-plugin - update to 3.5.1-4
easymock-javadoc - update to 3.5-4
easymock - update to 3.5-4
maven-javadoc - update to 3.5.4-5
maven-lib - update to 3.5.4-5
maven - update to 3.5.4-5
plexus-archiver-javadoc - update to 3.6.0-1
plexus-archiver - update to 3.6.0-1
apache-commons-net - update to 3.6-3
apache-commons-net-javadoc - update to 3.6-3
maven-compiler-plugin-javadoc - update to 3.7.0-2
maven-compiler-plugin - update to 3.7.0-2
apache-commons-lang3-javadoc - update to 3.7-3
apache-commons-lang3 - update to 3.7-3
assertj-core - update to 3.8.0-2
assertj-core-javadoc - update to 3.8.0-2
javassist - update to 3.18.1-8
javassist-javadoc - update to 3.18.1-8
plexus-utils-javadoc - update to 4.0.2-150200.3.14.1
plexus-utils - update to 4.0.2-150200.3.14.1
google-guice - update to 4.1-11
guice-assistedinject - update to 4.1-11
guice-bom - update to 4.1-11
guice-extensions - update to 4.1-11
guice-grapher - update to 4.1-11
guice-jmx - update to 4.1-11
guice-jndi - update to 4.1-11
guice-multibindings - update to 4.1-11
guice-parent - update to 4.1-11
guice-servlet - update to 4.1-11
guice-testlib - update to 4.1-11
guice-throwingproviders - update to 4.1-11
google-guice-javadoc - update to 4.1-11
httpcomponents-core - update to 4.4.10-4
httpcomponents-core-javadoc - update to 4.4.10-4
felix-parent - update to 4-5
httpcomponents-client - update to 4.5.5-4
httpcomponents-client-cache - update to 4.5.5-4
httpcomponents-client-javadoc - update to 4.5.5-4
xbean-javadoc - update to 4.8-1
xbean - update to 4.8-1
jvnet-parent - update to 4-10
junit-manual - update to 4.12-9
junit-javadoc - update to 4.12-9
junit - update to 4.12-9
plexus-pom - update to 5.0-2
javapackages-filesystem - update to 5.3.0-2
python3-javapackages - update to 5.3.0-2
maven-local - update to 5.3.0-2
javapackages-tools - update to 5.3.0-2
javapackages-local - update to 5.3.0-2
ivy-local - update to 5.3.0-2
osgi-compendium-javadoc - update to 6.0.0-5
osgi-compendium - update to 6.0.0-5
osgi-core-javadoc - update to 6.0.0-6
osgi-core - update to 6.0.0-6
osgi-annotation-javadoc - update to 6.0.0-7
osgi-annotation - update to 6.0.0-7
bcel-javadoc - update to 6.2-2
bcel - update to 6.2-2
objectweb-asm - update to 6.2-5
objectweb-asm-javadoc - update to 6.2-5
testng - update to 6.14.3-5
testng-javadoc - update to 6.14.3-5
javacc-manual - update to 7.0.2-6
javacc-javadoc - update to 7.0.2-6
javacc-demo - update to 7.0.2-6
javacc - update to 7.0.2-6
sonatype-oss-parent - update to 7-14
glassfish-master-pom - update to 8-11
sonatype-plugins-parent - update to 8-12
httpcomponents-project - update to 9-2
apache-parent - update to 19-2
guava20-testlib - update to 20.0-8
guava20-javadoc - update to 20.0-8
guava20 - update to 20.0-8
jboss-parent - update to 20-4
maven-shared - update to 22-6
spice-parent - update to 26-8
maven-parent - update to 27-5
maven-plugins-pom - update to 28-7
weld-parent - update to 34-5
forge-parent - update to 38-11
mojo-parent - update to 40-6
apache-commons-parent - update to 43-2

• https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642
• https://github.com/codehaus-plexus/plexus-utils/issues/294
• https://bugzilla.redhat.com/show_bug.cgi?id=2451409

• Path traversal in Codehaus plexus-utils
• SUSE update for plexus-utils
• Anolis OS update for plexus-utils
• Multiple vulnerabilities in Bamboo Data Center
• Multiple vulnerabilities in Red Hat Integration Camel Extensions for Quarkus 3.33
• MongoDB Enterprise Advanced with IBM update for plexus-utils
• Red Hat Enterprise Linux 9 update for plexus-utils
• Red Hat Enterprise Linux 10 update for plexus-utils
• Red Hat Enterprise Linux 9 update for plexus-utils
• Red Hat Enterprise Linux 9 update for plexus-utils
• Red Hat Enterprise Linux 9 update for the maven:3.9 module
• Red Hat Enterprise Linux 10 update for plexus-utils
• Red Hat Enterprise Linux 8 update for the maven:3.8 module
• Red Hat Enterprise Linux 8 update for the javapackages-tools:201801 module
• Anolis OS update for javapackages-tools:201801 module
• Multiple vulnerabilities in Red Hat Integration Camel Extensions for Quarkus
• Multiple vulnerabilities in IBM Rational Developer for i