{
  "@id": "urn:uuid:fe891c95-5826-4bbc-a67d-d3460595f1a3",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:01:00.133094+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/net.sourceforge.htmlunit/htmlunit@2.70.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/net.sourceforge.htmlunit/htmlunit@2.70.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:01:00.133094+00:00",
      "status_notes": "Vulnerability CVE-2020-5529 does not affect version 2.70.0-tuxcare.3 of net.sourceforge.htmlunit:htmlunit. CVE-2020-5529 affects HtmlUnit prior to 2.37.0 due to improper Rhino engine initialization allowing arbitrary Java code execution from JavaScript. The target version 2.70.0 already contains the upstream fix (commit 934390fefcd by rbri@rbri.de) that was shipped in upstream release 2.37.0, well before TuxCare onboarded version 2.70.0. The fix installs a ClassShutter blocking Java class access and removes deletion of Java-related global properties. Both defense components are present and functional in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.37.0), NVD (< 2.37.0), cve.org (< 2.37.0), Snyk (< 2.37.0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5529"
      },
      "impact_statement": "CVE-2020-5529 affects HtmlUnit prior to 2.37.0 due to improper Rhino engine initialization allowing arbitrary Java code execution from JavaScript. The target version 2.70.0 already contains the upstream fix (commit 934390fefcd by rbri@rbri.de) that was shipped in upstream release 2.37.0, well before TuxCare onboarded version 2.70.0. The fix installs a ClassShutter blocking Java class access and removes deletion of Java-related global properties. Both defense components are present and functional in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.37.0), NVD (< 2.37.0), cve.org (< 2.37.0), Snyk (< 2.37.0)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/net.sourceforge.htmlunit/htmlunit@2.70.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/net.sourceforge.htmlunit/htmlunit@2.70.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-26119 is fixed in version 2.70.0-tuxcare.3 of net.sourceforge.htmlunit:htmlunit.",
      "vulnerability": {
        "name": "CVE-2023-26119"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/net.sourceforge.htmlunit/htmlunit@2.70.0-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/net.sourceforge.htmlunit/htmlunit@2.70.0-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-49093 affects version 2.70.0-tuxcare.3 of net.sourceforge.htmlunit:htmlunit.",
      "vulnerability": {
        "name": "CVE-2023-49093"
      },
      "action_statement": "Vulnerability CVE-2023-49093 affects version 2.70.0-tuxcare.3 of net.sourceforge.htmlunit:htmlunit."
    }
  ]
}