{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:1d75eab2-bdd5-5b5f-beb0-a183e9d24b8b", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "commons-compress", "purl": "pkg:maven/org.apache.commons/commons-compress@1.26.0-tuxcare.1", "type": "library", "group": "org.apache.commons", "bom-ref": "pkg:maven/org.apache.commons/commons-compress@1.26.0-tuxcare.1", "version": "1.26.0-tuxcare.1", "pedigree": { "ancestors": [ { "name": "commons-compress", "purl": "pkg:maven/org.apache.commons/commons-compress@1.26.0", "type": "library", "group": "org.apache.commons", "version": "1.26.0" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2018-11771", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.26.0-tuxcare.1" } ], "bom-ref": "urn:uuid:ea71a3af-5105-564e-903e-46fbb758a60d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-11771 does not affect version 1.26.0-tuxcare.1 of org.apache.commons:commons-compress. not_affected \u2014 Apache Commons Compress version 1.26.0 is NOT affected by CVE-2018-11771. The vulnerability was fixed in upstream version 1.18, and version 1.26.0 already contains the upstream fix. The fix (commit a41ce6892) throws an IOException when EOF is reached prematurely while reading a stored ZIP entry, preventing the infinite stream condition that could cause denial of service. This fix was authored b...", "justification": "code_not_present" } }, { "id": "CVE-2018-1324", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.26.0-tuxcare.1" } ], "bom-ref": "urn:uuid:b31712a5-ebd7-50d4-9ed3-37829b6476a1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1324 does not affect version 1.26.0-tuxcare.1 of org.apache.commons:commons-compress. not_affected \u2014 CVE-2018-1324 is NOT present in commons-compress 1.26.0. The vulnerable infinite loop in X0017_StrongEncryptionHeader.parseCentralDirectoryFormat was fixed by upstream Apache before TuxCare onboarded this version. The first fix (commit 2a2f1dc48, Dec 2017) changed the loop counter from int to long to prevent integer overflow. A subsequent fix (commit fda4e34ff, Feb 2021) removed the loop entire...", "justification": "code_not_present" } }, { "id": "CVE-2019-12402", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.26.0-tuxcare.1" } ], "bom-ref": "urn:uuid:d1ec2e48-81f4-5e6c-a97f-1021b4268246", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-12402 does not affect version 1.26.0-tuxcare.1 of org.apache.commons:commons-compress. CVE-2019-12402 does NOT affect commons-compress 1.26.0-tuxcare.1. The vulnerability (infinite loop in NioZipEncoding.encode() when processing specially crafted file names) was fixed in upstream version 1.19 by commit 4ad5d80a (Stefan Bodewig, Aug 2019). The fix adds explicit loop termination on underflow/error states. Target version 1.26.0 already contains this upstream fix - it shipped in the base release before TuxCare onboarding. The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.15, < 1.19), NVD (>= 1.15, <= 1.18), cve.org (>= 1.15, <= 1.18), Snyk (>= 1.15, < 1.19).", "justification": "code_not_present" } }, { "id": "CVE-2021-35515", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.26.0-tuxcare.1" } ], "bom-ref": "urn:uuid:6d0ffe36-7ccd-59e5-8948-5e814ed47339", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-35515 affects version 1.26.0-tuxcare.1 of org.apache.commons:commons-compress." } }, { "id": "CVE-2021-35516", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.26.0-tuxcare.1" } ], "bom-ref": "urn:uuid:4b515c5d-4f3e-5531-8207-220190a02ead", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-35516 affects version 1.26.0-tuxcare.1 of org.apache.commons:commons-compress." } }, { "id": "CVE-2021-35517", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.26.0-tuxcare.1" } ], "bom-ref": "urn:uuid:f95f573e-28a6-5334-937d-8d2e5ee2163c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-35517 affects version 1.26.0-tuxcare.1 of org.apache.commons:commons-compress." } }, { "id": "CVE-2021-36090", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.26.0-tuxcare.1" } ], "bom-ref": "urn:uuid:82347b04-2925-5597-93a6-940c1ab95ea9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-36090 does not affect version 1.26.0-tuxcare.1 of org.apache.commons:commons-compress. The target repository at version 1.26.0 is NOT AFFECTED by CVE-2021-36090. The vulnerability was fixed in upstream Apache Commons Compress 1.21 (July 2021), and the fix is present in the 1.26.0 release that TuxCare onboarded. The fix includes: (1) validation of linkArrayLength in AsiExtraField.java before array allocation, and (2) introduction of IOUtils.readRange() methods that validate size limits before allocating memory, preventing out-of-memory attacks from malicious ZIP archives with attacker-controlled length fields.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.21), NVD (>= 1.0, < 1.21), cve.org (<= 1.20), Snyk (>= 1.0, < 1.21).", "justification": "code_not_present" } }, { "id": "CVE-2023-42503", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.26.0-tuxcare.1" } ], "bom-ref": "urn:uuid:7b291c45-0230-5da3-830f-79f144c1e9cc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-42503 does not affect version 1.26.0-tuxcare.1 of org.apache.commons:commons-compress. not_affected \u2014 CVE-2023-42503 does not affect Apache Commons Compress 1.26.0-tuxcare.1. The vulnerability was a denial-of-service attack via CPU exhaustion when parsing malformed PAX extended header time fields with BigDecimal. The upstream fix (validating input against regex pattern -?\\d{1,19}(?:\\.\\d{1,19})? before BigDecimal parsing) was released in version 1.24.0 and is present in the target version 1.26.0...", "justification": "code_not_present" } }, { "id": "CVE-2024-25710", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.26.0-tuxcare.1" } ], "bom-ref": "urn:uuid:f8d2d15b-ec8a-50f0-965b-9a842666088c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-25710 does not affect version 1.26.0-tuxcare.1 of org.apache.commons:commons-compress. Target version 1.26.0 is NOT vulnerable to CVE-2024-25710. The fix for the infinite loop vulnerability was already present in the upstream Apache Commons Compress 1.26.0 release that TuxCare onboarded. The defensive code that validates blocksize to prevent infinite loops is present at TapeInputStream.java:297-299, along with additional defensive checks in DumpArchiveUtil and DumpArchiveConstants. The fix was authored by Yakov Shafranovich (yakovsh@amazon.com) in upstream commit 8a9a5847c04 (COMPRESS-632) dated Nov 28, 2023, well before the 1.26.0 release in Feb 2024.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.3, < 1.26.0), NVD (>= 1.3, < 1.26.0), cve.org (>= 1.3, <= 1.25.0), Snyk (>= 1.3, < 1.26.0).", "justification": "code_not_present" } }, { "id": "CVE-2024-26308", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.26.0-tuxcare.1" } ], "bom-ref": "urn:uuid:2c702acc-52f5-58e7-8a27-c3165ee1c07c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-26308 does not affect version 1.26.0-tuxcare.1 of org.apache.commons:commons-compress. not_affected \u2014 CVE-2024-26308 addresses memory exhaustion vulnerabilities in pack200/unpack200 attribute parsing (COMPRESS-626, COMPRESS-628). The upstream fixes add EOF detection when reading from StringReader to prevent infinite loops. All fixes are present in the target version 1.26.0-tuxcare.1 because they shipped in the upstream Apache Commons Compress 1.26.0 release that TuxCare onboarded. The vulnerabl...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.26.0-tuxcare.1" } ] }