{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:6ee645fc-c146-52e0-81c9-c077648d6a9f",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "structured-event-log",
      "purl": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9",
      "type": "library",
      "group": "org.apache.pulsar",
      "bom-ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9",
      "version": "3.2.4-tuxcare.9",
      "pedigree": {
        "ancestors": [
          {
            "name": "structured-event-log",
            "purl": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4",
            "type": "library",
            "group": "org.apache.pulsar",
            "version": "3.2.4"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2007-1420",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:6510542a-bcb7-5b68-a0ee-881974924413",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2007-1420 is a false positive for org.apache.pulsar:structured-event-log 3.2.4-tuxcare.9. false_positive \u2014 CVE-2007-1420 concerns MySQL SERVER (version 5.x before 5.0.36) and its internal filesort function and information_schema query processing. The target repository is Apache Pulsar 3.2.4, a distributed pub-sub messaging platform. This is a wrong-project match - Pulsar does not contain MySQL server code."
      }
    },
    {
      "id": "CVE-2007-2691",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:54ae1809-0018-54a0-9a24-b9380c35de9a",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2007-2691 is a false positive for org.apache.pulsar:structured-event-log 3.2.4-tuxcare.9. false_positive \u2014 CVE-2007-2691 concerns MySQL privilege checking for RENAME TABLE SQL statements. The target repository is Apache Pulsar 3.2.4-tuxcare.1, a distributed pub-sub messaging platform, not MySQL. Apache Pulsar is a fundamentally different product (messaging system vs relational database) and contains no MySQL server source code. The MySQL references found are only client connectors (Debezium, Canal) ..."
      }
    },
    {
      "id": "CVE-2007-5925",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:623f2817-50c1-55ca-aadc-01caef0ea11d",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2007-5925 is a false positive for org.apache.pulsar:structured-event-log 3.2.4-tuxcare.9. false_positive \u2014 CVE-2007-5925 concerns MySQL server's InnoDB storage engine (ha_innodb.cc), but the target repository is Apache Pulsar version 3.2.4-tuxcare.1, a distributed pub-sub messaging platform. This is a wrong-project match. No MySQL server code or InnoDB engine code exists in the Pulsar repository."
      }
    },
    {
      "id": "CVE-2009-0819",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:43cbabc1-480f-527b-a346-ab7a41f7bf2c",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2009-0819 is a false positive for org.apache.pulsar:structured-event-log 3.2.4-tuxcare.9. false_positive \u2014 CVE-2009-0819 affects MySQL Server's internal XPath processing (sql/item_xmlfunc.cc). The target repository is Apache Pulsar 3.2.4, a Java-based pub-sub messaging platform. Pulsar contains only MySQL JDBC client libraries (mysql-connector-java 8.0.30) for connecting to MySQL databases. The vulnerable server-side XPath processing code does not exist in this repository. This is a wrong-project ma..."
      }
    },
    {
      "id": "CVE-2009-4028",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:87a1acec-0c85-5937-94d3-880a77f55dc7",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2009-4028 is a false positive for org.apache.pulsar:structured-event-log 3.2.4-tuxcare.9. false_positive \u2014 CVE-2009-4028 is a wrong-project match. The vulnerability affects MySQL's native C library code (vio_verify_callback in viosslfactories.c) which is not present in Apache Pulsar. Pulsar uses mysql-connector-java 8.0.11, a pure Java JDBC driver that does not contain or use the vulnerable native MySQL C code."
      }
    },
    {
      "id": "CVE-2010-1621",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:cf70267b-2bad-5c74-b1d1-0f4f443b1939",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2010-1621 is a false positive for org.apache.pulsar:structured-event-log 3.2.4-tuxcare.9. false_positive \u2014 CVE-2010-1621 concerns MySQL 5.1 server code (specifically the mysql_uninstall_plugin function in sql/sql_plugin.cc). The target repository is Apache Pulsar 3.2.4, a distributed pub-sub messaging system, which is a completely different product. While the repository contains MySQL client libraries (mysql-connector-java, debezium-connector-mysql) as dependencies for connecting TO external MySQL d..."
      }
    },
    {
      "id": "CVE-2010-1626",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:452fa428-c922-55fb-9daf-d3e34ecde5de",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2010-1626 is a false positive for org.apache.pulsar:structured-event-log 3.2.4-tuxcare.9. false_positive \u2014 CVE-2010-1626 concerns MySQL server's DROP TABLE implementation for MyISAM storage engine. The target repository is Apache Pulsar (a distributed pub-sub messaging platform), not MySQL. Pulsar does not contain MySQL server code - only client libraries (mysql-connector-java, debezium-connector-mysql) for connecting to external MySQL instances. The vulnerable component (MySQL server MyISAM DROP TA..."
      }
    },
    {
      "id": "CVE-2010-3677",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:d353255f-fe23-5833-a763-9f36a5f1b2b1",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2010-3677 does not affect version 3.2.4-tuxcare.9 of org.apache.pulsar:structured-event-log. not_affected \u2014 Apache Pulsar 3.2.4 is not affected by CVE-2010-3677. This CVE targets MySQL SERVER code (mysqld daemon's query execution engine), while Pulsar is a pub-sub messaging platform that uses MySQL only as an external data source via JDBC client libraries. Pulsar does not contain MySQL server code, does not process SQL queries itself, and cannot reach the vulnerability.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2010-3682",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:d02000da-3a71-5c21-b702-0cc70954a91f",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2010-3682 is a false positive for org.apache.pulsar:structured-event-log 3.2.4-tuxcare.9. false_positive \u2014 CVE-2010-3682 is a wrong-project match. The advisory concerns Oracle MySQL 5.1/5.0 database server (C++ codebase), while the target repository is Apache Pulsar 3.2.4, a Java-based distributed messaging platform. The vulnerable MySQL server code (Item_singlerow_subselect::store function) is not present in this repository."
      }
    },
    {
      "id": "CVE-2012-6612",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:7a1d7f78-3907-5587-a8d6-580700753b71",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2012-6612 does not affect version 3.2.4-tuxcare.9 of org.apache.pulsar:structured-event-log. not_affected \u2014 CVE-2012-6612 affects Apache Solr server components (UpdateRequestHandler for XSLT and XPathEntityProcessor) in versions before 4.1. This repository is Apache Pulsar 3.2.4, which is a different product. Pulsar contains a Solr connector that uses Solr 8.11.3 as a client library dependency, but does not contain or implement the vulnerable server-side components. The vulnerability pattern does not...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-6397",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:c75062dd-0496-594c-82c4-7ad1d4ed2554",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2013-6397 is a false positive for org.apache.pulsar:structured-event-log 3.2.4-tuxcare.9. false_positive \u2014 CVE-2013-6397 is a wrong-project match. The CVE concerns Apache Solr server code (SolrResourceLoader, XSLT response writer), but this repository is Apache Pulsar, a messaging platform. Pulsar contains only a Solr client connector (pulsar-io/solr) that uses the Solr client library (solr-solrj) to send documents to external Solr servers. The vulnerable server-side code path (directory traversal i..."
      }
    },
    {
      "id": "CVE-2013-6407",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:89b6dfa1-8509-52ba-878f-b27440d6f151",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-6407 does not affect version 3.2.4-tuxcare.9 of org.apache.pulsar:structured-event-log. not_affected \u2014 Apache Pulsar is not affected by CVE-2013-6407. This CVE concerns a vulnerability in Apache Solr server's UpdateRequestHandler for XML (versions before 4.1), which allows XXE attacks. Pulsar is a completely different Apache project (distributed pub-sub messaging platform) and does not contain any Solr server code. While Pulsar includes a connector module (pulsar-io-solr) that integrates with So...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-6408",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:11b049fb-18b7-5598-b1c4-fb78d45d6d3f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-6408 does not affect version 3.2.4-tuxcare.9 of org.apache.pulsar:structured-event-log. not_affected \u2014 Apache Pulsar 3.2.4 is not affected by CVE-2013-6408. This CVE targets the DocumentAnalysisRequestHandler in Apache Solr server (versions before 4.3.1). Pulsar's codebase contains only a Solr client connector (pulsar-io/solr) that sends data to external Solr servers; it does not implement any Solr server components. The vulnerable server-side XML parsing code does not exist in this repository.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2014-0001",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:aa9574f1-86fe-5f8f-bde2-b8044ffc48f7",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2014-0001 is a false positive for org.apache.pulsar:structured-event-log 3.2.4-tuxcare.9. false_positive \u2014 CVE-2014-0001 targets the MySQL/MariaDB C/C++ client library (client/mysql.cc), but this repository is Apache Pulsar 3.2.4, a distributed messaging platform. The affected component does not exist in this repository."
      }
    },
    {
      "id": "CVE-2014-8180",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:3a784bc1-83f6-5f67-b3fe-b553b99d305e",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2014-8180 is a false positive for org.apache.pulsar:structured-event-log 3.2.4-tuxcare.9. false_positive \u2014 CVE-2014-8180 concerns 'MongoDB on Red Hat Satellite 6' (a systems management product with MongoDB server authentication vulnerability), while this repository is Apache Pulsar 3.2.4 (a distributed pub-sub messaging platform). Pulsar contains only MongoDB CLIENT code (pulsar-io-mongo connector using mongodb-driver-reactivestreams:4.1.2) for connecting TO MongoDB servers, not MongoDB SERVER code ..."
      }
    },
    {
      "id": "CVE-2015-2325",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:09741d28-6cee-5abd-8cc6-e043fc37d817",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2015-2325 is a false positive for org.apache.pulsar:structured-event-log 3.2.4-tuxcare.9. false_positive \u2014 CVE-2015-2325 is a wrong-project match. The advisory concerns the PCRE (Perl Compatible Regular Expressions) C library, but the target repository is Apache Pulsar 3.2.4-tuxcare.1, a Java-based distributed messaging system that does not use, bundle, or depend on PCRE in any way."
      }
    },
    {
      "id": "CVE-2015-3414",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:116cbc18-2057-5b69-964c-75e4c5bbe781",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2015-3414 does not affect version 3.2.4-tuxcare.9 of org.apache.pulsar:structured-event-log. already_fixed \u2014 CVE-2015-3414 affects SQLite before version 3.8.9. Apache Pulsar uses sqlite-jdbc version 3.42.0.0, which bundles SQLite 3.42.0. This version already contains the fix for the collation-sequence name dequoting vulnerability. Pulsar's own codebase does not implement SQL parsing or collation dequoting logic; it relies on the sqlite-jdbc driver, which includes the patched SQLite library.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2015-3415",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:beae0f14-5ed1-5b3e-8097-6dc6902a9589",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2015-3415 does not affect version 3.2.4-tuxcare.9 of org.apache.pulsar:structured-event-log. not_affected \u2014 CVE-2015-3415 affects SQLite versions before 3.8.9 due to improper comparison operator implementation in CHECK clauses. The target repository (Apache Pulsar 3.2.4) uses SQLite only as a runtime dependency through org.xerial:sqlite-jdbc:3.42.0.0, which bundles SQLite 3.42.0 - a version released approximately 8 years after the fix. The vulnerable code (sqlite3VdbeExec in vdbe.c) does not exist in...",
        "justification": "requires_dependency"
      }
    },
    {
      "id": "CVE-2015-3416",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:d99df991-3399-53f4-977b-6fc3956f1af7",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2015-3416 does not affect version 3.2.4-tuxcare.9 of org.apache.pulsar:structured-event-log. not_affected \u2014 Apache Pulsar 3.2.4 is not affected by CVE-2015-3416. The vulnerability exists in SQLite's printf.c source code (sqlite3VXPrintf function), which is not present in the Pulsar repository. Pulsar uses sqlite-jdbc 3.42.0.0 as a Maven dependency, which bundles SQLite 3.42.0 - a version released in 2023 that is far newer than SQLite 3.8.9 (the version that fixed this vulnerability in 2015). The vuln...",
        "justification": "requires_dependency"
      }
    },
    {
      "id": "CVE-2015-3717",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:773b3ff3-8cdd-57c5-801b-c414506b5d59",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2015-3717 does not affect version 3.2.4-tuxcare.9 of org.apache.pulsar:structured-event-log. not_affected \u2014 The Pulsar repository does not contain the vulnerable SQLite printf C source code. CVE-2015-3717 affects SQLite's internal printf implementation (printf.c), which exists only in the sqlite-jdbc dependency binary, not in Pulsar's source code. Additionally, the sqlite-jdbc version (3.42.0.0, using SQLite 3.42.0 from 2023) already contains fixes for this 2015 vulnerability.",
        "justification": "requires_dependency"
      }
    },
    {
      "id": "CVE-2015-5895",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:be538a7d-c295-52ac-9138-3e42521d01ba",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2015-5895 does not affect version 3.2.4-tuxcare.9 of org.apache.pulsar:structured-event-log. not_affected \u2014 Apache Pulsar 3.2.4-tuxcare.1 is not affected by CVE-2015-5895. Pulsar uses SQLite via the org.xerial:sqlite-jdbc dependency (currently version 3.42.0.0, which bundles SQLite 3.42.0). CVE-2015-5895 affects SQLite versions before 3.8.10.2. Historical analysis shows that when Pulsar first introduced SQLite support in May 2020, it used version 3.8.11.2, which was already newer than the fixed versi...",
        "justification": "requires_dependency"
      }
    },
    {
      "id": "CVE-2015-6607",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:8837b12b-b4d1-5861-9762-bd7c04101f71",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2015-6607 does not affect version 3.2.4-tuxcare.9 of org.apache.pulsar:structured-event-log. not_affected \u2014 CVE-2015-6607 affects SQLite before version 3.8.9. Apache Pulsar 3.2.4-tuxcare.1 uses sqlite-jdbc 3.42.0.0 (which bundles SQLite 3.42.0), far newer than the vulnerable version. Historical analysis confirms Pulsar has never used a vulnerable SQLite version since SQLite support was first added in May 2020 with version 3.8.11.2 (already post-fix). The vulnerable code does not exist in the target r...",
        "justification": "requires_dependency"
      }
    },
    {
      "id": "CVE-2016-0610",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:9c7683d2-cea2-53f3-ae04-7cdce740ffa1",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2016-0610 is a false positive for org.apache.pulsar:structured-event-log 3.2.4-tuxcare.9. false_positive \u2014 CVE-2016-0610 concerns MySQL/MariaDB InnoDB storage engine. The target repository is Apache Pulsar 3.2.4, a distributed pub-sub messaging platform. This is a wrong-project match - Pulsar does not contain MySQL/MariaDB server code or the InnoDB storage engine."
      }
    },
    {
      "id": "CVE-2016-0616",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:61ded912-3c6a-55db-9c3d-fe2ab77ec5c3",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2016-0616 is a false positive for org.apache.pulsar:structured-event-log 3.2.4-tuxcare.9. false_positive \u2014 CVE-2016-0616 affects Oracle MySQL/MariaDB SERVER's query optimizer component. The target repository is Apache Pulsar 3.2.4, a distributed pub-sub messaging platform. Pulsar contains only JDBC client libraries (mariadb-java-client 2.7.5, mysql-connector-java 8.0.11) as dependencies, which are client-side drivers that connect TO MySQL/MariaDB servers. The vulnerable component (MySQL server-side ..."
      }
    },
    {
      "id": "CVE-2016-6153",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:a5171249-8b33-5b47-8b19-d8ae1edb6941",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-6153 does not affect version 3.2.4-tuxcare.9 of org.apache.pulsar:structured-event-log. not_affected \u2014 Apache Pulsar 3.2.4-tuxcare.1 is not affected by CVE-2016-6153. The vulnerability exists in SQLite's native C code (os_unix.c), which is not present in the Pulsar repository. Pulsar only uses SQLite as a runtime dependency (sqlite-jdbc 3.42.0.0), and does not vendor or bundle SQLite source code. Additionally, the dependency version bundles SQLite 3.42.0, which is significantly newer than the fi...",
        "justification": "requires_dependency"
      }
    },
    {
      "id": "CVE-2016-6494",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:6d5b0faf-424d-5fce-8c38-fa24b35dffb0",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2016-6494 is a false positive for org.apache.pulsar:structured-event-log 3.2.4-tuxcare.9. false_positive \u2014 CVE-2016-6494 is a false positive for this repository. The CVE concerns the MongoDB database shell executable (mongo/mongosh) and its .dbshell history file permissions. This repository is Apache Pulsar 3.2.4, a distributed pub-sub messaging platform - a completely different product. The only MongoDB-related component found is a connector module (pulsar-io/mongo) that uses the MongoDB Java drive..."
      }
    },
    {
      "id": "CVE-2017-10989",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:d2634896-8df1-52f2-9558-000cccaca319",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-10989 does not affect version 3.2.4-tuxcare.9 of org.apache.pulsar:structured-event-log. not_affected \u2014 Apache Pulsar 3.2.4 is not affected by CVE-2017-10989. The repository uses sqlite-jdbc 3.42.0.0 (bundling SQLite 3.42.0), which is not vulnerable. CVE-2017-10989 only affects SQLite versions through 3.19.3.",
        "justification": "requires_dependency"
      }
    },
    {
      "id": "CVE-2017-15365",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:a0ce756f-2d0b-5da9-9435-1a7d8323abbd",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2017-15365 is a false positive for org.apache.pulsar:structured-event-log 3.2.4-tuxcare.9. false_positive \u2014 CVE-2017-15365 is a wrong-project match. The vulnerability affects MariaDB/Percona XtraDB Cluster database server code (sql/event_data_objects.cc), specifically server-side DDL replication and ACL checking ordering in clustered environments. This repository is Apache Pulsar 3.2.4, a distributed messaging platform. While Pulsar contains I/O connectors that can connect to MariaDB databases as a c..."
      }
    },
    {
      "id": "CVE-2017-15945",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:4b5c86b9-c9f9-5633-8675-853266058d51",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2017-15945 is a false positive for org.apache.pulsar:structured-event-log 3.2.4-tuxcare.9. false_positive \u2014 CVE-2017-15945 is a false positive for this repository. The CVE concerns Gentoo installation scripts for MySQL/MariaDB/Percona database servers, while this repository is Apache Pulsar (a distributed messaging platform). The affected component code is absent from the entire repository."
      }
    },
    {
      "id": "CVE-2017-3302",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:81090bd7-c372-5ea7-8c09-d79f0a4c9f7f",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2017-3302 is a false positive for org.apache.pulsar:structured-event-log 3.2.4-tuxcare.9. false_positive \u2014 CVE-2017-3302 concerns libmysqlclient.so (the native C client library for MySQL/MariaDB), which is not present in the Apache Pulsar repository. Pulsar uses mysql-connector-java 8.0.30, a pure Java JDBC driver that is a completely different implementation and does not use the native libmysqlclient.so library. This is a wrong-project match."
      }
    },
    {
      "id": "CVE-2018-20346",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:0e602253-335e-58a9-afbd-66314ad1177b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-20346 does not affect version 3.2.4-tuxcare.9 of org.apache.pulsar:structured-event-log. not_affected \u2014 Apache Pulsar 3.2.4 is not affected by CVE-2018-20346. The repository uses sqlite-jdbc version 3.42.0.0, which is 17 major versions after the fix version (3.25.3). Additionally, Pulsar's JDBC SQLite sink does not use the FTS3 (Full-Text Search) extension at all, and provides no mechanism for arbitrary SQL execution. The attack vector requiring FTS3 shadow table manipulation and FTS3 queries can...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-20505",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:208b64a3-1914-5620-97f3-d018b7cdb86c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-20505 does not affect version 3.2.4-tuxcare.9 of org.apache.pulsar:structured-event-log. not_affected \u2014 CVE-2018-20505 affects SQLite 3.25.2 from December 2018, which allows denial of service crashes when queries are executed on tables with malformed PRIMARY KEYs. The target repository (Apache Pulsar 3.2.4-tuxcare.1) uses SQLite via the sqlite-jdbc 3.42.0.0 dependency, which bundles SQLite 3.42.0 from May 2023. The vulnerable code path exists in SQLite's internal C library, not in Pulsar's Java c...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-20506",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:e7c252ca-211f-5cee-9eb8-2cead24b6f40",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-20506 does not affect version 3.2.4-tuxcare.9 of org.apache.pulsar:structured-event-log. not_affected \u2014 Apache Pulsar 3.2.4 with sqlite-jdbc 3.42.0.0 is not affected by CVE-2018-20506. The vulnerability requires SQLite's FTS3 extension, which Pulsar does not use. Additionally, the SQLite library version (3.42.0) is much newer than the minimum fixed version (3.25.3).",
        "justification": "requires_dependency"
      }
    },
    {
      "id": "CVE-2018-8740",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:09744f9c-7ab7-589a-b1e8-1f330e2314bd",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-8740 does not affect version 3.2.4-tuxcare.9 of org.apache.pulsar:structured-event-log. not_affected \u2014 The target repository (Apache Pulsar 3.2.4-tuxcare.1) uses sqlite-jdbc version 3.42.0.0, which bundles SQLite 3.42.0. This version is well beyond the vulnerable version range specified in CVE-2018-8740 (SQLite through 3.22.0). The vulnerability exists in SQLite's C code (build.c and prepare.c) which is not present in this repository, and the dependency uses a patched version that was released y...",
        "justification": "requires_dependency"
      }
    },
    {
      "id": "CVE-2019-19645",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:051e8c9a-39bd-5eab-a899-666f6d6054e0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-19645 does not affect version 3.2.4-tuxcare.9 of org.apache.pulsar:structured-event-log. not_affected \u2014 CVE-2019-19645 affects SQLite's alter.c implementation (through version 3.30.1). The target repository (Apache Pulsar) does not contain any SQLite C source code - the vulnerable alter.c file does not exist in this repository. Pulsar uses SQLite only as a declared dependency via sqlite-jdbc:3.42.0.0, which includes SQLite 3.42.0 (much newer than the affected range). The vulnerable code path cann...",
        "justification": "requires_dependency"
      }
    },
    {
      "id": "CVE-2019-19646",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:d7628b60-251d-5b3f-8654-fc3df89613ec",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-19646 does not affect version 3.2.4-tuxcare.9 of org.apache.pulsar:structured-event-log. already_fixed \u2014 Apache Pulsar 3.2.4 uses sqlite-jdbc version 3.42.0.0, which bundles SQLite 3.42.0. This version is well beyond the affected range (SQLite \u2264 3.30.1) specified in CVE-2019-19646. The fix for this vulnerability was incorporated into SQLite versions released after 3.30.1, and the bundled SQLite 3.42.0 (released May 2023) already contains the fix.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-11655",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:c0c5573f-1bad-575c-b6d1-25a68f7d1883",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-11655 does not affect version 3.2.4-tuxcare.9 of org.apache.pulsar:structured-event-log. not_affected \u2014 Apache Pulsar 3.2.4-tuxcare.1 is not affected by CVE-2020-11655. The vulnerability exists in SQLite's C implementation (AggInfo object initialization in window-function query parsing), which is not present in Pulsar's codebase. Pulsar uses SQLite only as a declared dependency (org.xerial:sqlite-jdbc 3.42.0.0) for its JDBC connector, and the connector architecture does not accept or execute wind...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-11656",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:62513671-7a7e-5aa4-88c2-9016aa7707fe",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-11656 does not affect version 3.2.4-tuxcare.9 of org.apache.pulsar:structured-event-log. not_affected \u2014 Apache Pulsar 3.2.4 is not affected by CVE-2020-11656 (SQLite ALTER TABLE use-after-free). Pulsar uses SQLite only as a runtime dependency (sqlite-jdbc 3.42.0.0), and the embedded SQLite version (3.42.0) is well outside the affected range (through 3.31.1). No vulnerable SQLite source code exists in the Pulsar repository.",
        "justification": "requires_dependency"
      }
    },
    {
      "id": "CVE-2020-13434",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:95868fe2-2631-53d0-85b8-67cf3ef948fa",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-13434 does not affect version 3.2.4-tuxcare.9 of org.apache.pulsar:structured-event-log. already_fixed \u2014 The target repository (Apache Pulsar 3.2.4-tuxcare.1) already contains the fix for CVE-2020-13434. The vulnerability exists in SQLite's native library (integer overflow in sqlite3_str_vappendf), not in Pulsar's code. The target uses sqlite-jdbc version 3.42.0.0, which bundles SQLite 3.42.0, well beyond the affected range (SQLite \u2264 3.32.0). The fix was introduced in upstream commit ac41cfe35f (u...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-13435",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:3e447d28-d490-58d1-92dd-f91d9002042a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-13435 does not affect version 3.2.4-tuxcare.9 of org.apache.pulsar:structured-event-log. not_affected \u2014 The target repository (Apache Pulsar 3.2.4) is not affected by CVE-2020-13435. The vulnerable SQLite C code (sqlite3ExprCodeTarget in expr.c) does not exist in the Pulsar repository. Pulsar uses SQLite only as an external Maven dependency via sqlite-jdbc 3.42.0.0, which bundles SQLite version 3.42.0 - much newer than the affected versions (through 3.32.0) and already contains the fix.",
        "justification": "requires_dependency"
      }
    },
    {
      "id": "CVE-2020-13630",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:25f50c08-a19c-5cfc-a488-2402120ef0a8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-13630 does not affect version 3.2.4-tuxcare.9 of org.apache.pulsar:structured-event-log. not_affected \u2014 Apache Pulsar 3.2.4-tuxcare.1 is not affected by CVE-2020-13630. While Pulsar depends on sqlite-jdbc (version 3.42.0.0), the JDBC connector implementation does not use SQLite's FTS3 (Full Text Search) functionality or the snippet() function. The vulnerability requires executing FTS3 queries with snippet() to trigger the use-after-free in fts3EvalNextRow, but Pulsar's JDBC sink only generates ba...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2020-13631",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:8d1ec386-d6d7-5262-b2dc-454f8c3abe72",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-13631 does not affect version 3.2.4-tuxcare.9 of org.apache.pulsar:structured-event-log. not_affected \u2014 Apache Pulsar is not affected by CVE-2020-13631. The vulnerability concerns SQLite's ALTER TABLE RENAME operations on virtual tables, but Pulsar's JDBC connector does not perform any ALTER TABLE or RENAME operations. Additionally, the sqlite-jdbc dependency version 3.42.0.0 (containing SQLite 3.42.0) already includes the fix, as it is well after the vulnerable version (< 3.32.0).",
        "justification": "requires_dependency"
      }
    },
    {
      "id": "CVE-2020-13632",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:4ff06c02-0d2b-5358-9da3-de36605ada4e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-13632 does not affect version 3.2.4-tuxcare.9 of org.apache.pulsar:structured-event-log. not_affected \u2014 Apache Pulsar is not affected by CVE-2020-13632. The vulnerability exists in SQLite's native C code (ext/fts3/fts3_snippet.c) which is not present in the Pulsar repository. Pulsar only uses SQLite as an external JDBC dependency (sqlite-jdbc 3.42.0.0), and does not vendor or bundle SQLite source code.",
        "justification": "requires_dependency"
      }
    },
    {
      "id": "CVE-2020-15358",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:494ebb9d-89ef-54f9-99a7-85c676029aca",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-15358 does not affect version 3.2.4-tuxcare.9 of org.apache.pulsar:structured-event-log. already_fixed \u2014 The target repository (Apache Pulsar 3.2.4-tuxcare.1) already contains the fix for CVE-2020-15358. The SQLite JDBC dependency has been upgraded to version 3.42.0.0, which includes SQLite library version 3.42.0 - well above the minimum fixed version of 3.32.3. The original fix commit (ac41cfe35f) that upgraded from vulnerable version 3.8.11.2 to 3.36.0.3 is an ancestor of the current HEAD, and a...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-28912",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:35505847-9b5e-5c43-b719-f5ab588ea109",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2020-28912 is a false positive for org.apache.pulsar:structured-event-log 3.2.4-tuxcare.9. false_positive \u2014 CVE-2020-28912 concerns MariaDB Server's Windows named pipe security descriptors. The target repository is Apache Pulsar (a distributed messaging platform), not MariaDB Server. The only MariaDB reference is a JDBC client library dependency (mariadb-java-client:2.7.5), which is CLIENT code for connecting TO MariaDB servers and does not contain the server-side named pipe handling code that is vul..."
      }
    },
    {
      "id": "CVE-2021-32036",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:a5d9e14c-d09e-5d3d-b620-d268721419be",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-32036 does not affect version 3.2.4-tuxcare.9 of org.apache.pulsar:structured-event-log. not_affected \u2014 Apache Pulsar v3.2.4 is not affected by CVE-2021-32036. This CVE concerns MongoDB Server's command processing implementation, specifically the 'features' command handling. Pulsar contains only MongoDB client libraries (mongodb-driver-reactivestreams v4.1.2) used for connecting TO MongoDB databases, but does not contain any MongoDB Server code. The vulnerable code path (MongoDB Server's features...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-46666",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:9181cc75-414a-5f21-a644-cbb67dad1772",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-46666 does not affect version 3.2.4-tuxcare.9 of org.apache.pulsar:structured-event-log. not_affected \u2014 CVE-2021-46666 affects MariaDB server's query optimizer, not the MariaDB JDBC client library. Apache Pulsar uses only mariadb-java-client version 2.7.5 as a JDBC client dependency to connect to external MariaDB servers. The vulnerable code (query optimizer performing HAVING-to-WHERE clause pushdown) exists only in MariaDB server and is not present in Pulsar's codebase.",
        "justification": "requires_dependency"
      }
    },
    {
      "id": "CVE-2021-46667",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:1059f4d5-9b00-5828-88d4-9f2fb20ed6f4",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2021-46667 is a false positive for org.apache.pulsar:structured-event-log 3.2.4-tuxcare.9. false_positive \u2014 CVE-2021-46667 is a false positive for this repository. The CVE affects MariaDB server code (sql_lex.cc) which is not present in Apache Pulsar. The repository only contains a MariaDB JDBC client library as a dependency, which is a separate product from the MariaDB server."
      }
    },
    {
      "id": "CVE-2021-46669",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:af49a26a-38ba-5c40-90a8-d83a238ec04c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-46669 does not affect version 3.2.4-tuxcare.9 of org.apache.pulsar:structured-event-log. not_affected \u2014 Apache Pulsar 3.2.4-tuxcare.1 is not affected by CVE-2021-46669. This CVE concerns a use-after-free vulnerability in MariaDB server's convert_const_to_int function (part of SQL processing internals). Pulsar only contains a JDBC client connector (mariadb-java-client v2.7.5) that sends SQL queries to external MariaDB servers. The vulnerable code path does not exist in Pulsar's codebase.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-27385",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:35858613-4ba8-517b-938b-9c1083b81d7d",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2022-27385 is a false positive for org.apache.pulsar:structured-event-log 3.2.4-tuxcare.9. false_positive \u2014 CVE-2022-27385 concerns MariaDB Server (database engine), but this repository is Apache Pulsar (messaging platform). The vulnerable component Used_tables_and_const_cache::used_tables_and_const_cache_join exists only in MariaDB Server's C++ codebase and is not present in this repository. Pulsar has a dependency on mariadb-java-client (JDBC driver), which is a separate library unaffected by this ..."
      }
    },
    {
      "id": "CVE-2022-27449",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:152fc592-512e-581f-97a8-edc9b7138c39",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2022-27449 is a false positive for org.apache.pulsar:structured-event-log 3.2.4-tuxcare.9. false_positive \u2014 CVE-2022-27449 concerns MariaDB Server (a C++ database server), while the target repository is Apache Pulsar (a Java messaging platform). The target only depends on mariadb-java-client (a JDBC client library), which does not contain any MariaDB server code or the vulnerable component sql/item_func.cc. This is a wrong-project match."
      }
    },
    {
      "id": "CVE-2022-31621",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:78b12e25-52ae-535e-80d3-fd2aae9b09af",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2022-31621 is a false positive for org.apache.pulsar:structured-event-log 3.2.4-tuxcare.9. false_positive \u2014 CVE-2022-31621 concerns MariaDB Server's mariabackup utility, but the target repository is Apache Pulsar (a distributed messaging platform), not MariaDB Server. The affected component (extra/mariabackup/ds_xbstream.cc) does not exist in this repository."
      }
    },
    {
      "id": "CVE-2022-31622",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:cd9bf62e-e456-5926-bfd1-79a4ac28744c",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2022-31622 is a false positive for org.apache.pulsar:structured-event-log 3.2.4-tuxcare.9. false_positive \u2014 CVE-2022-31622 concerns MariaDB Server's mariabackup utility, but the target repository is Apache Pulsar (a distributed messaging platform). The vulnerable component (extra/mariabackup/ds_compress.cc and create_worker_threads function) does not exist in this repository. This is a wrong-project match."
      }
    },
    {
      "id": "CVE-2022-31623",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:a28943b6-591d-50a9-b67e-0f33069eac9f",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2022-31623 is a false positive for org.apache.pulsar:structured-event-log 3.2.4-tuxcare.9. false_positive \u2014 CVE-2022-31623 concerns MariaDB Server (specifically mariabackup in extra/mariabackup/ds_compress.cc), but this repository is Apache Pulsar, a distributed messaging platform. The affected component (MariaDB Server) is not present in this repository. The only MariaDB reference is mariadb-java-client v2.7.5, a pure Java JDBC client library for connecting to external MariaDB databases, which is a ..."
      }
    },
    {
      "id": "CVE-2022-31624",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:7aaebc40-ebfb-5d89-8479-049ce15acccf",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2022-31624 is a false positive for org.apache.pulsar:structured-event-log 3.2.4-tuxcare.9. false_positive \u2014 CVE-2022-31624 is a false positive for this repository. The vulnerability affects MariaDB Server's server_audit plugin (plugin/server_audit/server_audit.c), but this repository is Apache Pulsar 3.2.4-tuxcare.1, a Java-based distributed messaging platform. The affected MariaDB server component code is completely absent from this repository."
      }
    },
    {
      "id": "CVE-2022-35737",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:2b9caecb-b869-5ca5-a636-b16ac9ac40f6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-35737 does not affect version 3.2.4-tuxcare.9 of org.apache.pulsar:structured-event-log. already_fixed \u2014 CVE-2022-35737 has been fixed in the target repository. The vulnerability affects SQLite versions before 3.39.2, but the target uses sqlite-jdbc version 3.42.0.0 (which bundles SQLite 3.42.0), well above the fix threshold.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-5157",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:05f57d81-054b-5569-bf73-5d6bc4d3f483",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2023-5157 is a false positive for org.apache.pulsar:structured-event-log 3.2.4-tuxcare.9. false_positive \u2014 CVE-2023-5157 affects MariaDB Server, but this repository is Apache Pulsar. The affected component (MariaDB server network handling code) is absent from the entire repository. Pulsar only contains the MariaDB JDBC client library as a declared dependency, which is a different component that does not include server-side network listening code."
      }
    },
    {
      "id": "CVE-2023-7104",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:9a5805dc-e21d-59f9-87c3-6fa7451ec935",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-7104 does not affect version 3.2.4-tuxcare.9 of org.apache.pulsar:structured-event-log. not_affected \u2014 CVE-2023-7104 is a heap-based buffer overflow vulnerability in SQLite's session extension (sessionReadRecord function). While Apache Pulsar 3.2.4-tuxcare.1 uses sqlite-jdbc version 3.42.0.0 (which bundles SQLite 3.42.0 in the affected version range), the target is NOT AFFECTED because Pulsar does not use SQLite's session extension at all. The session extension requires explicit activation via A...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2025-6965",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:a3e95a4f-9278-5d0e-b39f-ec801000c060",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-6965 does not affect version 3.2.4-tuxcare.9 of org.apache.pulsar:structured-event-log. not_affected \u2014 Apache Pulsar 3.2.4-tuxcare.1 uses sqlite-jdbc version 3.42.0.0, which contains CVE-2025-6965 (SQLite aggregate term memory corruption). However, Pulsar's usage of SQLite is limited to INSERT, UPDATE, DELETE, and UPSERT operations through the pulsar-io-jdbc-sqlite sink. The vulnerability requires executing SELECT queries with aggregate functions (COUNT, SUM, AVG, etc.) where the aggregate term ...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2026-3494",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:bc274bd9-2656-5ffd-97de-a40a09d9805a",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2026-3494 is a false positive for org.apache.pulsar:structured-event-log 3.2.4-tuxcare.9. false_positive \u2014 CVE-2026-3494 describes a vulnerability in MariaDB server's audit plugin, but the target repository is Apache Pulsar (a distributed messaging platform), not MariaDB server. The repository only contains MariaDB client JDBC driver code for database connectivity, not the MariaDB server or its audit plugin. This is a wrong-project match."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.pulsar/structured-event-log@3.2.4-tuxcare.9"
    }
  ]
}