Critical security issue - org.codehaus.plexus:plexus-utils

[oana-anastasia-minciu-12]

XRAY scan shows a critical vulnerability issue for this dependency component:

CVE-2017-1000487 - CVSS score 9.8

Description: Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.

Recommendation is to upgrade the org.codehaus.plexus:plexus-utils component to a version above 3.0.16.

[muhlba91]

i have updated dependencies as per #588. as shown below this should be resolved with the next release.

❯ mvn dependency:tree
[INFO] Scanning for projects...
[WARNING] Ignoring incompatible plugin version 4.0.0-beta-1:
The plugin org.apache.maven.plugins:maven-resources-plugin:4.0.0-beta-1 has unmet prerequisites:
        Required Maven version 4.0.0-beta-3 is not met by current version 3.9.15
[INFO] Latest version of plugin org.apache.maven.plugins:maven-resources-plugin failed compatibility check
[INFO] Looking for compatible RELEASE version of plugin org.apache.maven.plugins:maven-resources-plugin
[INFO] Selected plugin org.apache.maven.plugins:maven-resources-plugin:3.5.0
[WARNING] Ignoring incompatible plugin version 4.0.0-beta-2:
The plugin org.apache.maven.plugins:maven-install-plugin:4.0.0-beta-2 has unmet prerequisites:
        Required Maven version 4.0.0-rc-2 is not met by current version 3.9.15
[INFO] Latest version of plugin org.apache.maven.plugins:maven-install-plugin failed compatibility check
[INFO] Looking for compatible RELEASE version of plugin org.apache.maven.plugins:maven-install-plugin
[WARNING] Ignoring incompatible plugin version 4.0.0-beta-1:
The plugin org.apache.maven.plugins:maven-install-plugin:4.0.0-beta-1 has unmet prerequisites:
        Required Maven version 4.0.0-beta-3 is not met by current version 3.9.15
[INFO] Selected plugin org.apache.maven.plugins:maven-install-plugin:3.1.4
[WARNING] Ignoring incompatible plugin version 4.0.0-beta-2:
The plugin org.apache.maven.plugins:maven-deploy-plugin:4.0.0-beta-2 has unmet prerequisites:
        Required Maven version 4.0.0-rc-2 is not met by current version 3.9.15
[INFO] Latest version of plugin org.apache.maven.plugins:maven-deploy-plugin failed compatibility check
[INFO] Looking for compatible RELEASE version of plugin org.apache.maven.plugins:maven-deploy-plugin
[WARNING] Ignoring incompatible plugin version 4.0.0-beta-1:
The plugin org.apache.maven.plugins:maven-deploy-plugin:4.0.0-beta-1 has unmet prerequisites:
        Required Maven version 4.0.0-beta-3 is not met by current version 3.9.15
[INFO] Selected plugin org.apache.maven.plugins:maven-deploy-plugin:3.1.4
[INFO]
[INFO] -----------< com.github.checkstyle:checkstyle-sonar-plugin >------------
[INFO] Building Checkstyle SonarQube Plugin 13.4.1-SNAPSHOT
[INFO]   from pom.xml
[INFO] ----------------------------[ sonar-plugin ]----------------------------
[INFO]
[INFO] --- dependency:3.7.0:tree (default-cli) @ checkstyle-sonar-plugin ---
[INFO] com.github.checkstyle:checkstyle-sonar-plugin:sonar-plugin:13.4.1-SNAPSHOT
[INFO] +- com.fasterxml.staxmate:staxmate:jar:2.4.1:provided
[INFO] |  \- org.codehaus.woodstox:stax2-api:jar:4.2.1:provided
[INFO] +- org.sonarsource.sslr-squid-bridge:sslr-squid-bridge:jar:2.7.1.392:compile
[INFO] |  +- org.picocontainer:picocontainer:jar:2.14.1:compile
[INFO] |  +- commons-lang:commons-lang:jar:2.6:compile
[INFO] |  \- com.google.code.findbugs:jsr305:jar:1.3.9:compile
[INFO] +- commons-io:commons-io:jar:2.22.0:compile
[INFO] +- org.apache.commons:commons-lang3:jar:3.20.0:compile
[INFO] +- commons-logging:commons-logging:jar:1.3.6:provided
[INFO] +- com.google.guava:guava:jar:33.6.0-jre:compile
[INFO] |  +- com.google.guava:failureaccess:jar:1.0.3:compile
[INFO] |  +- com.google.guava:listenablefuture:jar:9999.0-empty-to-avoid-conflict-with-guava:compile
[INFO] |  +- org.jspecify:jspecify:jar:1.0.0:compile
[INFO] |  +- com.google.errorprone:error_prone_annotations:jar:2.47.0:compile
[INFO] |  \- com.google.j2objc:j2objc-annotations:jar:3.1:compile
[INFO] +- org.sonarsource.api.plugin:sonar-plugin-api:jar:9.9.0.229:provided
[INFO] +- org.sonarsource.sonarqube:sonar-plugin-api-impl:jar:9.9.4.87374:test
[INFO] |  +- commons-codec:commons-codec:jar:1.15:compile
[INFO] |  \- org.apache.commons:commons-csv:jar:1.9.0:test
[INFO] +- org.xmlunit:xmlunit-legacy:jar:2.11.0:test
[INFO] |  \- org.xmlunit:xmlunit-core:jar:2.11.0:test
[INFO] |     \- jakarta.xml.bind:jakarta.xml.bind-api:jar:2.3.3:test
[INFO] |        \- jakarta.activation:jakarta.activation-api:jar:1.2.2:test
[INFO] +- org.slf4j:slf4j-api:jar:2.0.17:compile
[INFO] +- org.apache.maven:maven-core:jar:3.9.15:test
[INFO] |  +- org.apache.maven:maven-model:jar:3.9.15:test
[INFO] |  +- org.apache.maven:maven-settings:jar:3.9.15:test
[INFO] |  +- org.apache.maven:maven-settings-builder:jar:3.9.15:test
[INFO] |  |  \- org.codehaus.plexus:plexus-sec-dispatcher:jar:2.0:test
[INFO] |  |     \- org.codehaus.plexus:plexus-cipher:jar:2.0:test
[INFO] |  +- org.apache.maven:maven-builder-support:jar:3.9.15:test
[INFO] |  +- org.apache.maven:maven-repository-metadata:jar:3.9.15:test
[INFO] |  +- org.apache.maven:maven-artifact:jar:3.9.15:test
[INFO] |  +- org.apache.maven:maven-plugin-api:jar:3.9.15:test
[INFO] |  +- org.apache.maven:maven-model-builder:jar:3.9.15:test
[INFO] |  +- org.apache.maven:maven-resolver-provider:jar:3.9.15:test
[INFO] |  +- org.apache.maven.resolver:maven-resolver-impl:jar:1.9.27:test
[INFO] |  |  \- org.apache.maven.resolver:maven-resolver-named-locks:jar:1.9.27:test
[INFO] |  +- org.apache.maven.resolver:maven-resolver-api:jar:1.9.27:test
[INFO] |  +- org.apache.maven.resolver:maven-resolver-spi:jar:1.9.27:test
[INFO] |  +- org.apache.maven.resolver:maven-resolver-util:jar:1.9.27:test
[INFO] |  +- org.apache.maven.shared:maven-shared-utils:jar:3.4.2:test
[INFO] |  +- org.eclipse.sisu:org.eclipse.sisu.plexus:jar:1.0.0:test
[INFO] |  +- org.eclipse.sisu:org.eclipse.sisu.inject:jar:1.0.0:test
[INFO] |  +- org.ow2.asm:asm:jar:9.9.1:test
[INFO] |  +- com.google.inject:guice:jar:classes:5.1.0:test
[INFO] |  |  \- aopalliance:aopalliance:jar:1.0:test
[INFO] |  +- javax.inject:javax.inject:jar:1:test
[INFO] |  +- org.codehaus.plexus:plexus-utils:jar:3.6.1:compile
[INFO] |  +- org.codehaus.plexus:plexus-classworlds:jar:2.9.0:compile
[INFO] |  +- org.codehaus.plexus:plexus-interpolation:jar:1.29:test
[INFO] |  \- org.codehaus.plexus:plexus-component-annotations:jar:2.2.0:compile
[INFO] +- org.mockito:mockito-core:jar:3.12.4:test
[INFO] |  +- net.bytebuddy:byte-buddy:jar:1.11.13:test
[INFO] |  +- net.bytebuddy:byte-buddy-agent:jar:1.11.13:test
[INFO] |  \- org.objenesis:objenesis:jar:3.2:test
[INFO] +- org.hamcrest:hamcrest:jar:3.0:test
[INFO] +- junit:junit:jar:4.13.2:test
[INFO] +- org.sonarsource.sonarqube:sonar-testing-harness:jar:9.9.4.87374:test
[INFO] |  +- com.google.code.gson:gson:jar:2.10:test
[INFO] |  +- com.googlecode.json-simple:json-simple:jar:1.1.1:test
[INFO] |  +- com.sun.mail:javax.mail:jar:1.6.2:test
[INFO] |  |  \- javax.activation:activation:jar:1.1:test
[INFO] |  \- org.jsoup:jsoup:jar:1.15.3:test
[INFO] +- org.sonarsource.orchestrator:sonar-orchestrator:jar:3.42.0.312:test
[INFO] |  +- com.squareup.okhttp3:okhttp:jar:4.5.0:test
[INFO] |  |  +- com.squareup.okio:okio:jar:2.5.0:test
[INFO] |  |  |  \- org.jetbrains.kotlin:kotlin-stdlib-common:jar:1.3.70:test
[INFO] |  |  \- org.jetbrains.kotlin:kotlin-stdlib:jar:1.3.70:test
[INFO] |  |     \- org.jetbrains:annotations:jar:13.0:test
[INFO] |  +- org.apache.commons:commons-exec:jar:1.3:test
[INFO] |  +- com.eclipsesource.minimal-json:minimal-json:jar:0.9.5:test
[INFO] |  +- org.apache.httpcomponents:httpclient:jar:4.5.13:compile
[INFO] |  |  \- org.apache.httpcomponents:httpcore:jar:4.4.13:compile
[INFO] |  +- org.apache.httpcomponents:httpmime:jar:4.5.2:test
[INFO] |  +- com.h2database:h2:jar:2.1.210:test
[INFO] |  \- ch.qos.logback:logback-classic:jar:1.2.0:test
[INFO] |     \- ch.qos.logback:logback-core:jar:1.2.0:test
[INFO] +- org.slf4j:jcl-over-slf4j:jar:2.0.17:test
[INFO] +- org.slf4j:log4j-over-slf4j:jar:2.0.17:test
[INFO] +- org.easytesting:fest-assert:jar:1.4:test
[INFO] |  \- org.easytesting:fest-util:jar:1.1.6:test
[INFO] +- org.assertj:assertj-core:jar:3.27.7:test
[INFO] +- org.apache.ant:ant:jar:1.10.17:test
[INFO] |  \- org.apache.ant:ant-launcher:jar:1.10.17:test
[INFO] +- org.sonarsource.sonarqube:sonar-ws:jar:9.9.4.87374:test
[INFO] |  +- com.google.protobuf:protobuf-java:jar:3.21.12:test
[INFO] |  \- javax.annotation:javax.annotation-api:jar:1.3.2:test
[INFO] +- org.jacoco:org.jacoco.agent:jar:runtime:0.8.14:test
[INFO] +- com.puppycrawl.tools:checkstyle:jar:13.4.1:compile
[INFO] |  +- info.picocli:picocli:jar:4.7.7:compile
[INFO] |  +- org.antlr:antlr4-runtime:jar:4.13.2:compile
[INFO] |  +- commons-beanutils:commons-beanutils:jar:1.11.0:compile
[INFO] |  |  \- commons-collections:commons-collections:jar:3.2.2:compile
[INFO] |  +- org.slf4j:slf4j-simple:jar:2.0.17:runtime
[INFO] |  +- net.sf.saxon:Saxon-HE:jar:12.9:compile
[INFO] |  |  +- org.xmlresolver:xmlresolver:jar:5.3.3:compile
[INFO] |  |  \- org.xmlresolver:xmlresolver:jar:data:5.3.3:compile
[INFO] |  +- org.apache.maven.doxia:doxia-core:jar:1.12.0:compile
[INFO] |  |  +- org.apache.maven.doxia:doxia-sink-api:jar:1.12.0:compile
[INFO] |  |  +- org.apache.maven.doxia:doxia-logging-api:jar:1.12.0:compile
[INFO] |  |  +- org.codehaus.plexus:plexus-container-default:jar:2.1.0:compile
[INFO] |  |  |  \- org.apache.xbean:xbean-reflect:jar:3.7:compile
[INFO] |  |  \- org.apache.commons:commons-text:jar:1.3:compile
[INFO] |  \- org.apache.maven.doxia:doxia-module-xdoc:jar:1.12.0:compile
[INFO] +- com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:jar:2.21.2:compile
[INFO] |  +- org.yaml:snakeyaml:jar:2.5:compile
[INFO] |  \- com.fasterxml.jackson.core:jackson-core:jar:2.21.2:compile
[INFO] +- com.fasterxml.jackson.core:jackson-databind:jar:2.21.2:compile
[INFO] |  \- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile
[INFO] \- org.reflections:reflections:jar:0.10.2:compile
[INFO]    \- org.javassist:javassist:jar:3.28.0-GA:compile
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  0.549 s
[INFO] Finished at: 2026-04-27T19:27:37+02:00
[INFO] ------------------------------------------------------------------------

❯ mvn dependency:tree | grep plexus-utils
[INFO] |  +- org.codehaus.plexus:plexus-utils:jar:3.6.1:compile