{
  "@id": "urn:uuid:f83a23cf-d97f-4e6e-8baf-f5efe9b90206",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 10,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:10:25.284357+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.commons/commons-compress@1.24.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.commons/commons-compress@1.24.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T22:10:22.651819+00:00",
      "status_notes": "Vulnerability CVE-2018-11771 does not affect version 1.24.0-tuxcare.1 of org.apache.commons:commons-compress. not_affected \u2014 Target version 1.24.0 is not affected by CVE-2018-11771. The vulnerability was fixed in Apache Commons Compress 1.18, and version 1.24.0 already contains the upstream fix. The vulnerable pattern (silently returning -1 on ZIP entry truncation, allowing infinite stream) is not present; the code correctly throws IOException(\"Truncated ZIP file\") when detecting premature EOF.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11771"
      },
      "impact_statement": "not_affected \u2014 Target version 1.24.0 is not affected by CVE-2018-11771. The vulnerability was fixed in Apache Commons Compress 1.18, and version 1.24.0 already contains the upstream fix. The vulnerable pattern (silently returning -1 on ZIP entry truncation, allowing infinite stream) is not present; the code correctly throws IOException(\"Truncated ZIP file\") when detecting premature EOF."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.commons/commons-compress@1.24.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.commons/commons-compress@1.24.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T11:29:55.012374+00:00",
      "status_notes": "Vulnerability CVE-2018-1324 does not affect version 1.24.0-tuxcare.1 of org.apache.commons:commons-compress. not_affected \u2014 CVE-2018-1324 is NOT present in commons-compress version 1.24.0. The vulnerability involved an integer overflow in X0017_StrongEncryptionHeader.parseCentralDirectoryFormat() that could cause an infinite loop when processing ZIP archives with large rcount values. The vulnerable loop used an 'int' counter that would overflow and wrap to negative when rcount exceeded Integer.MAX_VALUE. The upstrea...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1324"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1324 is NOT present in commons-compress version 1.24.0. The vulnerability involved an integer overflow in X0017_StrongEncryptionHeader.parseCentralDirectoryFormat() that could cause an infinite loop when processing ZIP archives with large rcount values. The vulnerable loop used an 'int' counter that would overflow and wrap to negative when rcount exceeded Integer.MAX_VALUE. The upstrea..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.commons/commons-compress@1.24.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.commons/commons-compress@1.24.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2019-12402 does not affect version 1.24.0-tuxcare.1 of org.apache.commons:commons-compress. CVE-2019-12402 is not present in commons-compress 1.24.0. The vulnerability affecting versions 1.15-1.18 was fixed in version 1.19 by upstream commit 4ad5d80a (authored by bodewig@apache.org). The fix, which prevents infinite loops in NioZipEncoding.encode() by breaking when the encoder returns underflow or error status, was already present in the upstream 1.24.0 release that TuxCare onboarded. The vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.15, < 1.19), NVD (>= 1.15, <= 1.18), cve.org (>= 1.15, <= 1.18), Snyk (>= 1.15, < 1.19).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12402"
      },
      "impact_statement": "CVE-2019-12402 is not present in commons-compress 1.24.0. The vulnerability affecting versions 1.15-1.18 was fixed in version 1.19 by upstream commit 4ad5d80a (authored by bodewig@apache.org). The fix, which prevents infinite loops in NioZipEncoding.encode() by breaking when the encoder returns underflow or error status, was already present in the upstream 1.24.0 release that TuxCare onboarded. The vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.15, < 1.19), NVD (>= 1.15, <= 1.18), cve.org (>= 1.15, <= 1.18), Snyk (>= 1.15, < 1.19)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.commons/commons-compress@1.24.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.commons/commons-compress@1.24.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T00:22:41.069903+00:00",
      "status_notes": "Vulnerability CVE-2021-35515 affects version 1.24.0-tuxcare.1 of org.apache.commons:commons-compress.",
      "vulnerability": {
        "name": "CVE-2021-35515"
      },
      "action_statement": "Vulnerability CVE-2021-35515 affects version 1.24.0-tuxcare.1 of org.apache.commons:commons-compress."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.commons/commons-compress@1.24.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.commons/commons-compress@1.24.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T00:22:41.069903+00:00",
      "status_notes": "Vulnerability CVE-2021-35516 affects version 1.24.0-tuxcare.1 of org.apache.commons:commons-compress.",
      "vulnerability": {
        "name": "CVE-2021-35516"
      },
      "action_statement": "Vulnerability CVE-2021-35516 affects version 1.24.0-tuxcare.1 of org.apache.commons:commons-compress."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.commons/commons-compress@1.24.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.commons/commons-compress@1.24.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T00:22:41.069903+00:00",
      "status_notes": "Vulnerability CVE-2021-35517 affects version 1.24.0-tuxcare.1 of org.apache.commons:commons-compress.",
      "vulnerability": {
        "name": "CVE-2021-35517"
      },
      "action_statement": "Vulnerability CVE-2021-35517 affects version 1.24.0-tuxcare.1 of org.apache.commons:commons-compress."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.commons/commons-compress@1.24.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.commons/commons-compress@1.24.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:07:59.808671+00:00",
      "status_notes": "Vulnerability CVE-2021-36090 does not affect version 1.24.0-tuxcare.1 of org.apache.commons:commons-compress. CVE-2021-36090 (ZIP archive OOM via untrusted size fields) is NOT present in commons-compress 1.24.0. All three upstream fix commits (ef5d70b62, 80124dd9f, 2fe582582) shipped in the Apache Commons Compress 1.24.0 release that TuxCare onboarded. The vulnerable pattern (allocating arrays based on untrusted size fields without validation) has been replaced with safe incremental reading via IOUtils.readRange() across all archive formats (zip, ar, arj, cpio, dump, tar, sevenz). Authors: Stefan Bodewig (Apache), Matthijs Laan. No TuxCare backport was needed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.21), NVD (>= 1.0, < 1.21), cve.org (<= 1.20), Snyk (>= 1.0, < 1.21).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-36090"
      },
      "impact_statement": "CVE-2021-36090 (ZIP archive OOM via untrusted size fields) is NOT present in commons-compress 1.24.0. All three upstream fix commits (ef5d70b62, 80124dd9f, 2fe582582) shipped in the Apache Commons Compress 1.24.0 release that TuxCare onboarded. The vulnerable pattern (allocating arrays based on untrusted size fields without validation) has been replaced with safe incremental reading via IOUtils.readRange() across all archive formats (zip, ar, arj, cpio, dump, tar, sevenz). Authors: Stefan Bodewig (Apache), Matthijs Laan. No TuxCare backport was needed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.21), NVD (>= 1.0, < 1.21), cve.org (<= 1.20), Snyk (>= 1.0, < 1.21)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.commons/commons-compress@1.24.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.commons/commons-compress@1.24.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:23:26.744347+00:00",
      "status_notes": "Vulnerability CVE-2023-42503 does not affect version 1.24.0-tuxcare.1 of org.apache.commons:commons-compress. not_affected \u2014 The target Apache Commons Compress 1.24.0-tuxcare.1 is not affected by CVE-2023-42503. The vulnerability involved unvalidated parsing of PAX extended header time fields with BigDecimal, causing CPU exhaustion DoS. The upstream fix (commit 43354810a by Gary Gregory) added input validation to reject malformed time values before BigDecimal parsing. This fix was already present in the upstream 1.24...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-42503"
      },
      "impact_statement": "not_affected \u2014 The target Apache Commons Compress 1.24.0-tuxcare.1 is not affected by CVE-2023-42503. The vulnerability involved unvalidated parsing of PAX extended header time fields with BigDecimal, causing CPU exhaustion DoS. The upstream fix (commit 43354810a by Gary Gregory) added input validation to reject malformed time values before BigDecimal parsing. This fix was already present in the upstream 1.24..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.commons/commons-compress@1.24.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.commons/commons-compress@1.24.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-25710 is fixed in version 1.24.0-tuxcare.1 of org.apache.commons:commons-compress.",
      "vulnerability": {
        "name": "CVE-2024-25710"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.commons/commons-compress@1.24.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.commons/commons-compress@1.24.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-26308 affects version 1.24.0-tuxcare.1 of org.apache.commons:commons-compress.",
      "vulnerability": {
        "name": "CVE-2024-26308"
      },
      "action_statement": "Vulnerability CVE-2024-26308 affects version 1.24.0-tuxcare.1 of org.apache.commons:commons-compress."
    }
  ]
}