Skip to content

Fixed Maven-org.codehaus.plexus:plexus-utils-3.5.1 vulnerability (AST-144752)#168

Open
cx-anand-nandeshwar wants to merge 2 commits into
mainfrom
fix/plexus-utils_AST-144752
Open

Fixed Maven-org.codehaus.plexus:plexus-utils-3.5.1 vulnerability (AST-144752)#168
cx-anand-nandeshwar wants to merge 2 commits into
mainfrom
fix/plexus-utils_AST-144752

Conversation

@cx-anand-nandeshwar

@cx-anand-nandeshwar cx-anand-nandeshwar commented Apr 8, 2026

Copy link
Copy Markdown

Description

  • The fix is to override the transitive plexus-utils dependency via dependencyManagement to force a patched version.
  • Added a dependencyManagement block to pin it to 4.0.3 (the latest safe version), This forces Maven to use plexus-utils 4.0.3 across the entire dependency tree, overriding the vulnerable 3.5.1 that maven-plugin-api:3.9.6 pulls in transitively.

@github-actions github-actions Bot added the bug Something isn't working label Apr 8, 2026
@github-actions

github-actions Bot commented Apr 8, 2026

Copy link
Copy Markdown

Logo
Checkmarx One – Scan Summary & Detailsd58d9b4d-a589-45df-a934-eba94133cc54


Fixed Issues (1) Great job! The following issues were fixed in this Pull Request
Severity Issue Source File / Package
HIGH CVE-2025-67030 Maven-org.codehaus.plexus:plexus-utils-3.5.1

Policy Management Violations (1)
Policy Name Rule(s) Break Build
Commercial packages true

@cx-atish-jadhav cx-atish-jadhav changed the title - Fixed Maven-org.codehaus.plexus:plexus-utils-3.5.1 vulnerability (AST-144752) Fixed Maven-org.codehaus.plexus:plexus-utils-3.5.1 vulnerability (AST-144752) Apr 9, 2026

@cx-anurag-dalke cx-anurag-dalke left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ok

@cx-anurag-dalke cx-anurag-dalke force-pushed the fix/plexus-utils_AST-144752 branch from 04f65b7 to 1bb8632 Compare July 6, 2026 11:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants