CVE-2017-1000487 OS Command Injection in Plexus-utils

What is CVE-2017-1000487?

CVE-2017-1000487 is a critical vulnerability in Debian Debian Linux, published on 3 Jan 2018.

Official description

Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.

Weakness: CWE-78

Which versions are affected by CVE-2017-1000487?

2 open source packages ship an affected version, including org.codehaus.plexus:plexus-utils. It affects 2 products.

Products include Codehaus-Plexus Plexus-Utils, Debian Debian Linux.

How do I fix CVE-2017-1000487?

Upgrade org.codehaus.plexus:plexus-utils to 3.0.16 or later.

Is CVE-2017-1000487 being exploited?

There is no known exploitation of CVE-2017-1000487 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in Debian Debian Linux

• CVE-2025-67030 Plexus-Utils has a Directory Traversal vulnerability in its extractFile method High 8.8
• CVE-2022-4244 Codehaus-plexus: directory traversal High 7.5
• CVE-2022-4245 Codehaus-plexus: xml external entity (xxe) injection Medium 4.3

All Debian Debian Linux vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2017-1000487, DLA-1236-1, DLA-1237-1, DSA-4146-1, DSA-4149-1, GHSA-8vhq-qq4p-grq3 and 2 more.