org.codehaus.plexus:plexus-utils is a collection of various utility classes to ease working with strings, files, command lines, XML and more. Affected versions of this package are vulnerable to XML External Entity (XXE) Injection. org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequence. This means that text contained in the command string could be interpreted as XML and allow for XML injection. https://security.snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSPLEXUS-461102
Created extra-enforcer-rules tracking bugs for this issue: Affects: fedora-37 [bug 2157638] Created maven tracking bugs for this issue: Affects: fedora-37 [bug 2157639] Created maven-antrun-plugin tracking bugs for this issue: Affects: fedora-37 [bug 2157640] Created maven-compiler-plugin tracking bugs for this issue: Affects: fedora-37 [bug 2157641] Created maven-plugin-bundle tracking bugs for this issue: Affects: fedora-37 [bug 2157642] Created maven-source-plugin tracking bugs for this issue: Affects: fedora-37 [bug 2157643] Created pomchecker tracking bugs for this issue: Affects: fedora-37 [bug 2157644]
adjusting RHPAM from OOSS to affected/delegated per request from engineering in https://issues.redhat.com/browse/RHDM-1949.
This issue has been addressed in the following products: RHINT Camel-K-1.10.1 Via RHSA-2023:3906 https://access.redhat.com/errata/RHSA-2023:3906
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2022-4245
The component is shipped in rhint-camel-spring-boot-3 but its not used. Changing specific impact to low.