{
  "@id": "urn:uuid:c826babb-9167-44cc-889d-9bafe3b4b131",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T17:19:35.189823+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.commons/commons-compress@1.15-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.commons/commons-compress@1.15-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2018-11771 affects version 1.15-tuxcare.1 of org.apache.commons:commons-compress.",
      "vulnerability": {
        "name": "CVE-2018-11771"
      },
      "action_statement": "Vulnerability CVE-2018-11771 affects version 1.15-tuxcare.1 of org.apache.commons:commons-compress."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.commons/commons-compress@1.15-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.commons/commons-compress@1.15-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2018-1324 is fixed in version 1.15-tuxcare.1 of org.apache.commons:commons-compress.",
      "vulnerability": {
        "name": "CVE-2018-1324"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.commons/commons-compress@1.15-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.commons/commons-compress@1.15-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2019-12402 is fixed in version 1.15-tuxcare.1 of org.apache.commons:commons-compress.",
      "vulnerability": {
        "name": "CVE-2019-12402"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.commons/commons-compress@1.15-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.commons/commons-compress@1.15-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-35515 is fixed in version 1.15-tuxcare.1 of org.apache.commons:commons-compress.",
      "vulnerability": {
        "name": "CVE-2021-35515"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.commons/commons-compress@1.15-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.commons/commons-compress@1.15-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-35516 affects version 1.15-tuxcare.1 of org.apache.commons:commons-compress.",
      "vulnerability": {
        "name": "CVE-2021-35516"
      },
      "action_statement": "Vulnerability CVE-2021-35516 affects version 1.15-tuxcare.1 of org.apache.commons:commons-compress."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.commons/commons-compress@1.15-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.commons/commons-compress@1.15-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-35517 affects version 1.15-tuxcare.1 of org.apache.commons:commons-compress.",
      "vulnerability": {
        "name": "CVE-2021-35517"
      },
      "action_statement": "Vulnerability CVE-2021-35517 affects version 1.15-tuxcare.1 of org.apache.commons:commons-compress."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.commons/commons-compress@1.15-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.commons/commons-compress@1.15-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-36090 affects version 1.15-tuxcare.1 of org.apache.commons:commons-compress.",
      "vulnerability": {
        "name": "CVE-2021-36090"
      },
      "action_statement": "Vulnerability CVE-2021-36090 affects version 1.15-tuxcare.1 of org.apache.commons:commons-compress."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.commons/commons-compress@1.15-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.commons/commons-compress@1.15-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:26:45.505192+00:00",
      "status_notes": "Vulnerability CVE-2023-42503 does not affect version 1.15-tuxcare.1 of org.apache.commons:commons-compress. not_affected \u2014 Target version 1.15 is NOT affected by CVE-2023-42503. The vulnerable code (BigDecimal parsing of PAX extended header time fields) was introduced in Apache Commons Compress v1.22 with COMPRESS-612 for higher-precision timestamps. Version 1.15 uses Double.parseDouble() for mtime parsing (TarArchiveEntry.java:1065), which does not exhibit the O(n\u00b2) algorithmic complexity that causes DoS with larg...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-42503"
      },
      "impact_statement": "not_affected \u2014 Target version 1.15 is NOT affected by CVE-2023-42503. The vulnerable code (BigDecimal parsing of PAX extended header time fields) was introduced in Apache Commons Compress v1.22 with COMPRESS-612 for higher-precision timestamps. Version 1.15 uses Double.parseDouble() for mtime parsing (TarArchiveEntry.java:1065), which does not exhibit the O(n\u00b2) algorithmic complexity that causes DoS with larg..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.commons/commons-compress@1.15-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.commons/commons-compress@1.15-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-25710 affects version 1.15-tuxcare.1 of org.apache.commons:commons-compress, and is fixed in 1.15-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2024-25710"
      },
      "action_statement": "Vulnerability CVE-2024-25710 affects version 1.15-tuxcare.1 of org.apache.commons:commons-compress, and is fixed in 1.15-tuxcare.2."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.commons/commons-compress@1.15-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.commons/commons-compress@1.15-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T17:19:35.189823+00:00",
      "status_notes": "Vulnerability CVE-2024-26308 does not affect version 1.15-tuxcare.1 of org.apache.commons:commons-compress. Prechecker: No vulnerable code from the fix was found, and none of the calls on the lines the fix removes appear in this version. Version 1.15 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-4265-ccf5-phj5 (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-26308"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and none of the calls on the lines the fix removes appear in this version. Version 1.15 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-4265-ccf5-phj5 (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only)."
    }
  ]
}