{
  "@id": "urn:uuid:2643ffd4-3881-4081-ab4f-cfaf6d92c093",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 10,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:10:25.284357+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.commons/commons-compress@1.21-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.commons/commons-compress@1.21-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T22:08:00.065578+00:00",
      "status_notes": "Vulnerability CVE-2018-11771 does not affect version 1.21-tuxcare.1 of org.apache.commons:commons-compress. not_affected \u2014 Target version 1.21 is NOT affected by CVE-2018-11771. The upstream fix (commit a41ce6892 by Apache developer Stefan Bodewig) was shipped in Apache Commons Compress 1.18 (August 2018), which predates TuxCare's onboarding of version 1.20. The target code at HEAD contains the fix: ZipArchiveInputStream.readStored() throws IOException(\"Truncated ZIP file\") when detecting truncation (line 603), and...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11771"
      },
      "impact_statement": "not_affected \u2014 Target version 1.21 is NOT affected by CVE-2018-11771. The upstream fix (commit a41ce6892 by Apache developer Stefan Bodewig) was shipped in Apache Commons Compress 1.18 (August 2018), which predates TuxCare's onboarding of version 1.20. The target code at HEAD contains the fix: ZipArchiveInputStream.readStored() throws IOException(\"Truncated ZIP file\") when detecting truncation (line 603), and..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.commons/commons-compress@1.21-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.commons/commons-compress@1.21-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T11:31:30.050601+00:00",
      "status_notes": "Vulnerability CVE-2018-1324 does not affect version 1.21-tuxcare.1 of org.apache.commons:commons-compress. not_affected \u2014 Version 1.21 is not affected by CVE-2018-1324. The vulnerable code pattern (integer overflow in loop counter when parsing ZIP extra fields) does not exist in this version. The upstream Apache Commons Compress project fixed this issue in commit 2a2f1dc4 (Dec 2017) by changing the loop variable from int to long, and later refactored the code to remove the loop entirely before releasing version 1....",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1324"
      },
      "impact_statement": "not_affected \u2014 Version 1.21 is not affected by CVE-2018-1324. The vulnerable code pattern (integer overflow in loop counter when parsing ZIP extra fields) does not exist in this version. The upstream Apache Commons Compress project fixed this issue in commit 2a2f1dc4 (Dec 2017) by changing the loop variable from int to long, and later refactored the code to remove the loop entirely before releasing version 1...."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.commons/commons-compress@1.21-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.commons/commons-compress@1.21-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2019-12402 does not affect version 1.21-tuxcare.1 of org.apache.commons:commons-compress. CVE-2019-12402 affects Apache Commons Compress versions 1.15-1.18 and was fixed in version 1.19. The target repository is at version 1.21-tuxcare.1, which already contains the upstream fix. The fix (commit 4ad5d80a6 by Stefan Bodewig) adds a break condition to prevent infinite loops in the file name encoding algorithm. This fix was part of the upstream 1.21 release when TuxCare onboarded it, so the vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.15, < 1.19), NVD (>= 1.15, <= 1.18), cve.org (>= 1.15, <= 1.18), Snyk (>= 1.15, < 1.19).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12402"
      },
      "impact_statement": "CVE-2019-12402 affects Apache Commons Compress versions 1.15-1.18 and was fixed in version 1.19. The target repository is at version 1.21-tuxcare.1, which already contains the upstream fix. The fix (commit 4ad5d80a6 by Stefan Bodewig) adds a break condition to prevent infinite loops in the file name encoding algorithm. This fix was part of the upstream 1.21 release when TuxCare onboarded it, so the vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.15, < 1.19), NVD (>= 1.15, <= 1.18), cve.org (>= 1.15, <= 1.18), Snyk (>= 1.15, < 1.19)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.commons/commons-compress@1.21-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.commons/commons-compress@1.21-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T00:22:41.069903+00:00",
      "status_notes": "Vulnerability CVE-2021-35515 affects version 1.21-tuxcare.1 of org.apache.commons:commons-compress.",
      "vulnerability": {
        "name": "CVE-2021-35515"
      },
      "action_statement": "Vulnerability CVE-2021-35515 affects version 1.21-tuxcare.1 of org.apache.commons:commons-compress."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.commons/commons-compress@1.21-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.commons/commons-compress@1.21-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T00:22:41.069903+00:00",
      "status_notes": "Vulnerability CVE-2021-35516 affects version 1.21-tuxcare.1 of org.apache.commons:commons-compress.",
      "vulnerability": {
        "name": "CVE-2021-35516"
      },
      "action_statement": "Vulnerability CVE-2021-35516 affects version 1.21-tuxcare.1 of org.apache.commons:commons-compress."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.commons/commons-compress@1.21-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.commons/commons-compress@1.21-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T00:22:41.069903+00:00",
      "status_notes": "Vulnerability CVE-2021-35517 affects version 1.21-tuxcare.1 of org.apache.commons:commons-compress.",
      "vulnerability": {
        "name": "CVE-2021-35517"
      },
      "action_statement": "Vulnerability CVE-2021-35517 affects version 1.21-tuxcare.1 of org.apache.commons:commons-compress."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.commons/commons-compress@1.21-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.commons/commons-compress@1.21-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:07:59.808671+00:00",
      "status_notes": "Vulnerability CVE-2021-36090 does not affect version 1.21-tuxcare.1 of org.apache.commons:commons-compress. The target Apache Commons Compress 1.21-tuxcare.1 is NOT affected by CVE-2021-36090. The vulnerability was fixed in the upstream Apache Commons Compress 1.21 release (July 13, 2021) before TuxCare onboarded it. The fixes include: (1) AsiExtraField validation to prevent blind allocation based on untrusted length fields, and (2) introduction of IOUtils.readRange() to replace the \"allocate-then-fill\" pattern with a \"read-what's-available\" approach. Both fixes are present in the target at HEAD (2927b347a), having been included in the onboarding commit b256a32d8.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.21), NVD (>= 1.0, < 1.21), cve.org (<= 1.20), Snyk (>= 1.0, < 1.21).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-36090"
      },
      "impact_statement": "The target Apache Commons Compress 1.21-tuxcare.1 is NOT affected by CVE-2021-36090. The vulnerability was fixed in the upstream Apache Commons Compress 1.21 release (July 13, 2021) before TuxCare onboarded it. The fixes include: (1) AsiExtraField validation to prevent blind allocation based on untrusted length fields, and (2) introduction of IOUtils.readRange() to replace the \"allocate-then-fill\" pattern with a \"read-what's-available\" approach. Both fixes are present in the target at HEAD (2927b347a), having been included in the onboarding commit b256a32d8.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.21), NVD (>= 1.0, < 1.21), cve.org (<= 1.20), Snyk (>= 1.0, < 1.21)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.commons/commons-compress@1.21-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.commons/commons-compress@1.21-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:23:26.744347+00:00",
      "status_notes": "Vulnerability CVE-2023-42503 does not affect version 1.21-tuxcare.1 of org.apache.commons:commons-compress. not_affected \u2014 Target version 1.21-tuxcare.1 is NOT affected by CVE-2023-42503. The vulnerable code path was introduced in version 1.22 with COMPRESS-612 (high-precision timestamp support using BigDecimal). Version 1.21 uses Double.parseDouble() for mtime parsing, which does not exhibit the algorithmic complexity issue (JDK-6560193) that BigDecimal has with pathological inputs. Additionally, version 1.21 does...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2023-42503"
      },
      "impact_statement": "not_affected \u2014 Target version 1.21-tuxcare.1 is NOT affected by CVE-2023-42503. The vulnerable code path was introduced in version 1.22 with COMPRESS-612 (high-precision timestamp support using BigDecimal). Version 1.21 uses Double.parseDouble() for mtime parsing, which does not exhibit the algorithmic complexity issue (JDK-6560193) that BigDecimal has with pathological inputs. Additionally, version 1.21 does..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.commons/commons-compress@1.21-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.commons/commons-compress@1.21-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-25710 is fixed in version 1.21-tuxcare.1 of org.apache.commons:commons-compress.",
      "vulnerability": {
        "name": "CVE-2024-25710"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.commons/commons-compress@1.21-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.commons/commons-compress@1.21-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-26308 is fixed in version 1.21-tuxcare.1 of org.apache.commons:commons-compress.",
      "vulnerability": {
        "name": "CVE-2024-26308"
      }
    }
  ]
}