{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:b9580684-55b7-53c9-b60f-6e9889c1a36c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "commons-compress", "purl": "pkg:maven/org.apache.commons/commons-compress@1.4.1-tuxcare.1", "type": "library", "group": "org.apache.commons", "bom-ref": "pkg:maven/org.apache.commons/commons-compress@1.4.1-tuxcare.1", "version": "1.4.1-tuxcare.1", "pedigree": { "ancestors": [ { "name": "commons-compress", "purl": "pkg:maven/org.apache.commons/commons-compress@1.4.1", "type": "library", "group": "org.apache.commons", "version": "1.4.1" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2018-11771", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.4.1-tuxcare.1" } ], "bom-ref": "urn:uuid:981fd102-7303-55d6-9cc3-e182ff410a38", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-11771 is fixed in version 1.4.1-tuxcare.1 of org.apache.commons:commons-compress." } }, { "id": "CVE-2018-1324", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.4.1-tuxcare.1" } ], "bom-ref": "urn:uuid:6e935107-e24a-5848-bd58-ffd99b4c0840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1324 does not affect version 1.4.1-tuxcare.1 of org.apache.commons:commons-compress. not_affected \u2014 Version 1.4.1 is not affected by CVE-2018-1324. The vulnerability exists in the X0017_StrongEncryptionHeader class (added in version ~1.11) which contains a loop using an int counter that can overflow when processing large rcount values from ZIP extra fields, causing an infinite loop. This class does not exist in version 1.4.1, which predates its introduction. While version 1.4.1 does parse ZIP...", "justification": "code_not_reachable" } }, { "id": "CVE-2019-12402", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.4.1-tuxcare.1" } ], "bom-ref": "urn:uuid:43e3ed2b-32aa-5e5d-b62c-4f1a62ce01dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-12402 affects version 1.4.1-tuxcare.1 of org.apache.commons:commons-compress." } }, { "id": "CVE-2021-35515", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.4.1-tuxcare.1" } ], "bom-ref": "urn:uuid:d72619f5-d02b-51e8-9687-68f8dbd77f75", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-35515 does not affect version 1.4.1-tuxcare.1 of org.apache.commons:commons-compress. not_affected \u2014 Apache Commons Compress version 1.4.1 is not affected by CVE-2021-35515. The vulnerability exists in the SevenZ (7Z) archive format handler's codec chain traversal logic, but version 1.4.1 does not include SevenZ support. The entire sevenz package was added in a later version (present in 1.18+). TuxCare backported fixes to versions 1.18, 1.19, and 1.20, but version 1.4.1 predates the SevenZ fea...", "justification": "code_not_present" } }, { "id": "CVE-2021-35516", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.4.1-tuxcare.1" } ], "bom-ref": "urn:uuid:09d1e3b0-06b4-58b6-a61b-64677541f817", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-35516 does not affect version 1.4.1-tuxcare.1 of org.apache.commons:commons-compress. not_affected \u2014 Apache Commons Compress version 1.4.1 is not affected by CVE-2021-35516. This version predates the introduction of 7Z archive support and contains no code capable of parsing 7Z archives. The vulnerability requires processing specially crafted 7Z archive metadata, but version 1.4.1 only supports ar, cpio, dump, jar, tar, and zip formats.", "justification": "code_not_present" } }, { "id": "CVE-2021-35517", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.4.1-tuxcare.1" } ], "bom-ref": "urn:uuid:7d2cbcce-6d50-5303-aa24-dcc668c202c9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-35517 affects version 1.4.1-tuxcare.1 of org.apache.commons:commons-compress." } }, { "id": "CVE-2021-36090", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.4.1-tuxcare.1" } ], "bom-ref": "urn:uuid:deb56744-f381-5618-bb58-5c12dae2509f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-36090 affects version 1.4.1-tuxcare.1 of org.apache.commons:commons-compress." } }, { "id": "CVE-2023-42503", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.4.1-tuxcare.1" } ], "bom-ref": "urn:uuid:903eebd9-3325-5406-a151-63ff34b07903", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-42503 does not affect version 1.4.1-tuxcare.1 of org.apache.commons:commons-compress. not_affected \u2014 Apache Commons Compress version 1.4.1 is NOT affected by CVE-2023-42503. The vulnerable code (BigDecimal parsing of PAX extended header time fields) was introduced in version 1.22 (March 2022) via COMPRESS-612. Version 1.4.1 (released 2012) uses Double.parseDouble() for the single PAX time field it processes (mtime), which does not exhibit the algorithmic complexity vulnerability (JDK-6560193) ...", "justification": "code_not_present" } }, { "id": "CVE-2024-25710", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.4.1-tuxcare.1" } ], "bom-ref": "urn:uuid:61122077-e19b-5107-84b0-e1bce6fb2f0e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-25710 is fixed in version 1.4.1-tuxcare.1 of org.apache.commons:commons-compress." } }, { "id": "CVE-2024-26308", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.4.1-tuxcare.1" } ], "bom-ref": "urn:uuid:349125d3-6c14-52cc-805c-a3c00cb09059", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-26308 does not affect version 1.4.1-tuxcare.1 of org.apache.commons:commons-compress. not_affected \u2014 Apache Commons Compress version 1.4.1 is NOT affected by CVE-2024-26308. The vulnerability affects the Apache Harmony pack200/unpack200 implementation and 7z archiver support, neither of which exist in version 1.4.1. Version 1.4.1 uses the JDK's built-in java.util.jar.Pack200 API (not the vulnerable Apache Harmony implementation) and does not have 7z/SevenZ archiver support. The vulnerable comp...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.4.1-tuxcare.1" } ] }