{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:cb31fb23-15bb-5a31-8419-3971b53429c0", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "commons-compress", "purl": "pkg:maven/org.apache.commons/commons-compress@1.27.1-tuxcare.1", "type": "library", "group": "org.apache.commons", "bom-ref": "pkg:maven/org.apache.commons/commons-compress@1.27.1-tuxcare.1", "version": "1.27.1-tuxcare.1", "pedigree": { "ancestors": [ { "name": "commons-compress", "purl": "pkg:maven/org.apache.commons/commons-compress@1.27.1", "type": "library", "group": "org.apache.commons", "version": "1.27.1" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2018-11771", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.27.1-tuxcare.1" } ], "bom-ref": "urn:uuid:3dc7e4b5-5f66-5313-b3c7-0c762f06bb56", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-11771 does not affect version 1.27.1-tuxcare.1 of org.apache.commons:commons-compress. not_affected \u2014 CVE-2018-11771 affects Apache Commons Compress versions 1.7 to 1.17. The target version 1.27.1 already contains the upstream fix (commit a41ce6892 by bodewig@apache.org) that was introduced in version 1.18. The vulnerability involved ZipArchiveInputStream.readStored() silently returning -1 on truncated stored entries, which could lead to infinite streams and DoS. The fix changes this behavior t...", "justification": "code_not_present" } }, { "id": "CVE-2018-1324", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.27.1-tuxcare.1" } ], "bom-ref": "urn:uuid:596e05fd-848a-5bcb-a9e8-13d37a6b6ffd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1324 does not affect version 1.27.1-tuxcare.1 of org.apache.commons:commons-compress. not_affected \u2014 CVE-2018-1324 affects Apache Commons Compress versions 1.11-1.15. The target version 1.27.1 is NOT affected. The vulnerability involved an infinite loop in X0017_StrongEncryptionHeader.parseCentralDirectoryFormat() caused by integer overflow when a malicious rcount value exceeded Integer.MAX_VALUE. The upstream fix (commit 2a2f1dc48, December 2017) changed the loop counter from int to long. Sub...", "justification": "code_not_present" } }, { "id": "CVE-2019-12402", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.27.1-tuxcare.1" } ], "bom-ref": "urn:uuid:c036b31a-146d-5d3d-ac88-3ed08cdc40eb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-12402 does not affect version 1.27.1-tuxcare.1 of org.apache.commons:commons-compress. The target repository (Apache Commons Compress 1.27.1-tuxcare.1) is not affected by CVE-2019-12402. The vulnerability, which caused an infinite loop in the file name encoding algorithm, was fixed in upstream version 1.19. The target version 1.27.1 contains the upstream vendor's fix (commit 4ad5d80a by bodewig@apache.org) that adds a break statement to exit the encoding loop on underflow/error conditions. This fix was already present in the upstream release 1.27.1 when TuxCare onboarded it, making this an upstream fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.15, < 1.19), NVD (>= 1.15, <= 1.18), cve.org (>= 1.15, <= 1.18), Snyk (>= 1.15, < 1.19).", "justification": "code_not_present" } }, { "id": "CVE-2021-35515", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.27.1-tuxcare.1" } ], "bom-ref": "urn:uuid:8b640962-412b-5a2e-8ede-ba12b13b543d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-35515 affects version 1.27.1-tuxcare.1 of org.apache.commons:commons-compress." } }, { "id": "CVE-2021-35516", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.27.1-tuxcare.1" } ], "bom-ref": "urn:uuid:d8ad08a5-65cc-5baf-bc8f-34817b376610", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-35516 affects version 1.27.1-tuxcare.1 of org.apache.commons:commons-compress." } }, { "id": "CVE-2021-35517", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.27.1-tuxcare.1" } ], "bom-ref": "urn:uuid:f79af136-1cb3-5142-9bf7-a38bbae1f006", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-35517 affects version 1.27.1-tuxcare.1 of org.apache.commons:commons-compress." } }, { "id": "CVE-2021-36090", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.27.1-tuxcare.1" } ], "bom-ref": "urn:uuid:8af71059-5ee8-5fb9-8898-512bd7405c8b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-36090 does not affect version 1.27.1-tuxcare.1 of org.apache.commons:commons-compress. CVE-2021-36090 is NOT present in Apache Commons Compress 1.27.1-tuxcare.1. The vulnerability (excessive memory allocation from inflated archive header size fields) was fixed by upstream in June-August 2021 via three commits: (1) AsiExtraField bounds validation (ef5d70b62), (2) systematic replacement of \"allocate-then-fill\" with IOUtils.readRange() deferred allocation (80124dd9f), and (3) readRange() buffer limit fix (2fe582582). All three fixes were already present in the upstream 1.27.1 release that TuxCare onboarded on 2026-07-13 (commit 65438dbb2). The vulnerable pattern\u2014allocating arrays based on untrusted size fields before validating available data\u2014has been eliminated from all archive parsing code paths.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.21), NVD (>= 1.0, < 1.21), cve.org (<= 1.20), Snyk (>= 1.0, < 1.21).", "justification": "code_not_present" } }, { "id": "CVE-2023-42503", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.27.1-tuxcare.1" } ], "bom-ref": "urn:uuid:ff148275-52e2-56a1-9e0c-71ecb4101def", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-42503 does not affect version 1.27.1-tuxcare.1 of org.apache.commons:commons-compress. not_affected \u2014 Target version 1.27.1 is NOT vulnerable to CVE-2023-42503. The fix for this BigDecimal DoS vulnerability was introduced in upstream Apache Commons Compress version 1.24.0 (commit 43354810a, dated 2023-09-03 by Gary Gregory). The target includes this upstream fix, which validates PAX extended header time field values against a regex pattern (-?\\d{1,19}(?:\\.\\d{1,19})?) before BigDecimal parsing, ...", "justification": "code_not_present" } }, { "id": "CVE-2024-25710", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.27.1-tuxcare.1" } ], "bom-ref": "urn:uuid:7f285ebd-1582-5f5f-bbde-52f0af5f1592", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-25710 does not affect version 1.27.1-tuxcare.1 of org.apache.commons:commons-compress. CVE-2024-25710 (infinite loop due to integer overflow in blockSize calculation) is NOT present in commons-compress 1.27.1-tuxcare.1. The fix is present at TapeInputStream.java:297-299 where blockSize is validated to be greater than 0 after multiplication. This fix was shipped in the upstream Apache Commons Compress 1.27.1 release (commit 8a9a5847 by yakovsh@amazon.com) and onboarded by TuxCare in commit 65438dbb2. The vulnerable pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.3, < 1.26.0), NVD (>= 1.3, < 1.26.0), cve.org (>= 1.3, <= 1.25.0), Snyk (>= 1.3, < 1.26.0).", "justification": "code_not_present" } }, { "id": "CVE-2024-26308", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.27.1-tuxcare.1" } ], "bom-ref": "urn:uuid:70ef344a-e9ff-5eb8-b2ea-0ad58069e3db", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-26308 does not affect version 1.27.1-tuxcare.1 of org.apache.commons:commons-compress. not_affected \u2014 Target version 1.27.1 is not affected by CVE-2024-26308. The upstream vendor (Apache Commons Compress) fixed this vulnerability in version 1.26 through commits 90a4d8b3 (COMPRESS-626), d2bbbf32 (COMPRESS-628), and 9ced3f97, all authored by Gary Gregory in September-October 2022. These fixes were already present in the upstream 1.27.1 release that TuxCare onboarded. The vulnerable code pattern (...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.27.1-tuxcare.1" } ] }