{ "@id": "urn:uuid:b7dc159d-677d-4de4-ba78-98e0ad2aa4c3", "role": "Document Creator", "author": "https://tuxcare.com", "version": 10, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-06T17:19:35.189823+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.commons/commons-compress@1.19-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.commons/commons-compress@1.19-tuxcare.1" } } ], "timestamp": "2026-11-02T22:11:12.204425+00:00", "status_notes": "Vulnerability CVE-2018-11771 does not affect version 1.19-tuxcare.1 of org.apache.commons:commons-compress. not_affected \u2014 CVE-2018-11771 is NOT present in Apache Commons Compress 1.19-tuxcare.2. The vulnerability affects versions 1.7-1.17 and was fixed in upstream version 1.18. The target version 1.19 already contains the upstream fix (commit a41ce6892) that throws IOException(\"Truncated ZIP file\") when EOF is reached on a stored entry with mismatched size, preventing the infinite stream condition. Both key defens...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-11771" }, "impact_statement": "not_affected \u2014 CVE-2018-11771 is NOT present in Apache Commons Compress 1.19-tuxcare.2. The vulnerability affects versions 1.7-1.17 and was fixed in upstream version 1.18. The target version 1.19 already contains the upstream fix (commit a41ce6892) that throws IOException(\"Truncated ZIP file\") when EOF is reached on a stored entry with mismatched size, preventing the infinite stream condition. Both key defens..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.commons/commons-compress@1.19-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.commons/commons-compress@1.19-tuxcare.1" } } ], "timestamp": "2026-11-03T11:31:00.036199+00:00", "status_notes": "Vulnerability CVE-2018-1324 does not affect version 1.19-tuxcare.1 of org.apache.commons:commons-compress. not_affected \u2014 CVE-2018-1324 affects Apache Commons Compress versions 1.11-1.15 via an integer overflow in the X0017_StrongEncryptionHeader.parseCentralDirectoryFormat method that could cause an infinite loop. The upstream fix (commit 2a2f1dc48) changed the loop counter from int to long. This fix was already present in the upstream Apache Commons Compress 1.19 release that TuxCare onboarded. The target versio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1324" }, "impact_statement": "not_affected \u2014 CVE-2018-1324 affects Apache Commons Compress versions 1.11-1.15 via an integer overflow in the X0017_StrongEncryptionHeader.parseCentralDirectoryFormat method that could cause an infinite loop. The upstream fix (commit 2a2f1dc48) changed the loop counter from int to long. This fix was already present in the upstream Apache Commons Compress 1.19 release that TuxCare onboarded. The target versio..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.commons/commons-compress@1.19-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.commons/commons-compress@1.19-tuxcare.1" } } ], "timestamp": "2026-11-04T09:10:25.284357+00:00", "status_notes": "Vulnerability CVE-2019-12402 does not affect version 1.19-tuxcare.1 of org.apache.commons:commons-compress. CVE-2019-12402 describes an infinite loop vulnerability in Apache Commons Compress versions 1.15-1.18. The target is version 1.19-tuxcare.2. The vulnerability was fixed in upstream commit 4ad5d80a6 (August 23, 2019) by adding a break condition to the NioZipEncoding.encode() method. This fix was already present in the upstream 1.19 release, which TuxCare onboarded without modification. The vulnerable code pattern (infinite loop in file name encoding) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.15, < 1.19), NVD (>= 1.15, <= 1.18), cve.org (>= 1.15, <= 1.18), Snyk (>= 1.15, < 1.19).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12402" }, "impact_statement": "CVE-2019-12402 describes an infinite loop vulnerability in Apache Commons Compress versions 1.15-1.18. The target is version 1.19-tuxcare.2. The vulnerability was fixed in upstream commit 4ad5d80a6 (August 23, 2019) by adding a break condition to the NioZipEncoding.encode() method. This fix was already present in the upstream 1.19 release, which TuxCare onboarded without modification. The vulnerable code pattern (infinite loop in file name encoding) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.15, < 1.19), NVD (>= 1.15, <= 1.18), cve.org (>= 1.15, <= 1.18), Snyk (>= 1.15, < 1.19)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.commons/commons-compress@1.19-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.commons/commons-compress@1.19-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-35515 is fixed in version 1.19-tuxcare.1 of org.apache.commons:commons-compress.", "vulnerability": { "name": "CVE-2021-35515" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.commons/commons-compress@1.19-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.commons/commons-compress@1.19-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-35516 affects version 1.19-tuxcare.1 of org.apache.commons:commons-compress, and is fixed in 1.19-tuxcare.2.", "vulnerability": { "name": "CVE-2021-35516" }, "action_statement": "Vulnerability CVE-2021-35516 affects version 1.19-tuxcare.1 of org.apache.commons:commons-compress, and is fixed in 1.19-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.commons/commons-compress@1.19-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.commons/commons-compress@1.19-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-35517 affects version 1.19-tuxcare.1 of org.apache.commons:commons-compress, and is fixed in 1.19-tuxcare.2.", "vulnerability": { "name": "CVE-2021-35517" }, "action_statement": "Vulnerability CVE-2021-35517 affects version 1.19-tuxcare.1 of org.apache.commons:commons-compress, and is fixed in 1.19-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.commons/commons-compress@1.19-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.commons/commons-compress@1.19-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-36090 affects version 1.19-tuxcare.1 of org.apache.commons:commons-compress, and is fixed in 1.19-tuxcare.2.", "vulnerability": { "name": "CVE-2021-36090" }, "action_statement": "Vulnerability CVE-2021-36090 affects version 1.19-tuxcare.1 of org.apache.commons:commons-compress, and is fixed in 1.19-tuxcare.2." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.commons/commons-compress@1.19-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.commons/commons-compress@1.19-tuxcare.1" } } ], "timestamp": "2026-11-03T12:25:55.953386+00:00", "status_notes": "Vulnerability CVE-2023-42503 does not affect version 1.19-tuxcare.1 of org.apache.commons:commons-compress. not_affected \u2014 Version 1.19-tuxcare.2 is not affected by CVE-2023-42503. The vulnerable BigDecimal parsing code was introduced in version 1.22 with COMPRESS-612 (high-precision time field support). Version 1.19 uses Double.parseDouble() for mtime parsing (line 1118), which does not exhibit the O(n\u00b2) algorithmic complexity issue that BigDecimal has with malicious input (very long fractions or exponent notation...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2023-42503" }, "impact_statement": "not_affected \u2014 Version 1.19-tuxcare.2 is not affected by CVE-2023-42503. The vulnerable BigDecimal parsing code was introduced in version 1.22 with COMPRESS-612 (high-precision time field support). Version 1.19 uses Double.parseDouble() for mtime parsing (line 1118), which does not exhibit the O(n\u00b2) algorithmic complexity issue that BigDecimal has with malicious input (very long fractions or exponent notation..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.commons/commons-compress@1.19-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.commons/commons-compress@1.19-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-25710 affects version 1.19-tuxcare.1 of org.apache.commons:commons-compress, and is fixed in 1.19-tuxcare.2.", "vulnerability": { "name": "CVE-2024-25710" }, "action_statement": "Vulnerability CVE-2024-25710 affects version 1.19-tuxcare.1 of org.apache.commons:commons-compress, and is fixed in 1.19-tuxcare.2." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.commons/commons-compress@1.19-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.commons/commons-compress@1.19-tuxcare.1" } } ], "timestamp": "2026-11-06T17:19:35.189823+00:00", "status_notes": "Vulnerability CVE-2024-26308 does not affect version 1.19-tuxcare.1 of org.apache.commons:commons-compress. Prechecker: No vulnerable code from the fix was found, and none of the calls on the lines the fix removes appear in this version. Version 1.19 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-4265-ccf5-phj5 (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-26308" }, "impact_statement": "Prechecker: No vulnerable code from the fix was found, and none of the calls on the lines the fix removes appear in this version. Version 1.19 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-4265-ccf5-phj5 (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only)." } ] }