{ "@id": "urn:uuid:fdd0895e-9289-4d10-a26a-0d8af97f5fe2", "role": "Document Creator", "author": "https://tuxcare.com", "version": 10, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-04T09:10:25.284357+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.commons/commons-compress@1.25.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.commons/commons-compress@1.25.0-tuxcare.1" } } ], "timestamp": "2026-11-02T22:12:57.135800+00:00", "status_notes": "Vulnerability CVE-2018-11771 does not affect version 1.25.0-tuxcare.1 of org.apache.commons:commons-compress. not_affected \u2014 CVE-2018-11771 affects Apache Commons Compress versions 1.7-1.17. The vulnerability allows denial of service through incorrect EOF handling in ZipArchiveInputStream when reading specially crafted ZIP archives with truncated stored entries. Target version 1.25.0-tuxcare.1 is NOT affected because the upstream fix (commit a41ce6892cb by Stefan Bodewig) was already present in upstream release 1.18,...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-11771" }, "impact_statement": "not_affected \u2014 CVE-2018-11771 affects Apache Commons Compress versions 1.7-1.17. The vulnerability allows denial of service through incorrect EOF handling in ZipArchiveInputStream when reading specially crafted ZIP archives with truncated stored entries. Target version 1.25.0-tuxcare.1 is NOT affected because the upstream fix (commit a41ce6892cb by Stefan Bodewig) was already present in upstream release 1.18,..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.commons/commons-compress@1.25.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.commons/commons-compress@1.25.0-tuxcare.1" } } ], "timestamp": "2026-11-03T11:30:06.448914+00:00", "status_notes": "Vulnerability CVE-2018-1324 does not affect version 1.25.0-tuxcare.1 of org.apache.commons:commons-compress. not_affected \u2014 CVE-2018-1324 affects Apache Commons Compress versions 1.11-1.15, causing an infinite loop in the ZIP extra field parser. The target version 1.25.0 is NOT affected because the vulnerable code pattern (the for loop iterating over rcount and hashSize in X0017_StrongEncryptionHeader.parseCentralDirectoryFormat) was completely removed by upstream in February 2021 (commit fda4e34ff). This removal wa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1324" }, "impact_statement": "not_affected \u2014 CVE-2018-1324 affects Apache Commons Compress versions 1.11-1.15, causing an infinite loop in the ZIP extra field parser. The target version 1.25.0 is NOT affected because the vulnerable code pattern (the for loop iterating over rcount and hashSize in X0017_StrongEncryptionHeader.parseCentralDirectoryFormat) was completely removed by upstream in February 2021 (commit fda4e34ff). This removal wa..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.commons/commons-compress@1.25.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.commons/commons-compress@1.25.0-tuxcare.1" } } ], "timestamp": "2026-11-04T09:10:25.284357+00:00", "status_notes": "Vulnerability CVE-2019-12402 does not affect version 1.25.0-tuxcare.1 of org.apache.commons:commons-compress. Target version 1.25.0 is not affected by CVE-2019-12402. The vulnerability (infinite loop in NioZipEncoding.encode() when CharsetEncoder returns underflow/error states) was fixed in upstream version 1.19 by commit 4ad5d80a (author: bodewig@apache.org). This fix was already present in the upstream release 1.25.0 that TuxCare onboarded. The fix code (break statement on underflow/error) is present at NioZipEncoding.java:173-174. No vulnerable encoding paths exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.15, < 1.19), NVD (>= 1.15, <= 1.18), cve.org (>= 1.15, <= 1.18), Snyk (>= 1.15, < 1.19).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12402" }, "impact_statement": "Target version 1.25.0 is not affected by CVE-2019-12402. The vulnerability (infinite loop in NioZipEncoding.encode() when CharsetEncoder returns underflow/error states) was fixed in upstream version 1.19 by commit 4ad5d80a (author: bodewig@apache.org). This fix was already present in the upstream release 1.25.0 that TuxCare onboarded. The fix code (break statement on underflow/error) is present at NioZipEncoding.java:173-174. No vulnerable encoding paths exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.15, < 1.19), NVD (>= 1.15, <= 1.18), cve.org (>= 1.15, <= 1.18), Snyk (>= 1.15, < 1.19)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.commons/commons-compress@1.25.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.commons/commons-compress@1.25.0-tuxcare.1" } } ], "timestamp": "2026-10-29T00:22:41.069903+00:00", "status_notes": "Vulnerability CVE-2021-35515 affects version 1.25.0-tuxcare.1 of org.apache.commons:commons-compress.", "vulnerability": { "name": "CVE-2021-35515" }, "action_statement": "Vulnerability CVE-2021-35515 affects version 1.25.0-tuxcare.1 of org.apache.commons:commons-compress." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.commons/commons-compress@1.25.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.commons/commons-compress@1.25.0-tuxcare.1" } } ], "timestamp": "2026-10-29T00:22:41.069903+00:00", "status_notes": "Vulnerability CVE-2021-35516 affects version 1.25.0-tuxcare.1 of org.apache.commons:commons-compress.", "vulnerability": { "name": "CVE-2021-35516" }, "action_statement": "Vulnerability CVE-2021-35516 affects version 1.25.0-tuxcare.1 of org.apache.commons:commons-compress." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.commons/commons-compress@1.25.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.commons/commons-compress@1.25.0-tuxcare.1" } } ], "timestamp": "2026-10-29T00:22:41.069903+00:00", "status_notes": "Vulnerability CVE-2021-35517 affects version 1.25.0-tuxcare.1 of org.apache.commons:commons-compress.", "vulnerability": { "name": "CVE-2021-35517" }, "action_statement": "Vulnerability CVE-2021-35517 affects version 1.25.0-tuxcare.1 of org.apache.commons:commons-compress." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.commons/commons-compress@1.25.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.commons/commons-compress@1.25.0-tuxcare.1" } } ], "timestamp": "2026-11-04T09:07:59.808671+00:00", "status_notes": "Vulnerability CVE-2021-36090 does not affect version 1.25.0-tuxcare.1 of org.apache.commons:commons-compress. CVE-2021-36090 is NOT present in commons-compress 1.25.0-tuxcare.1. The vulnerability (DoS via excessive memory allocation from untrusted length fields in ZIP archives) was fixed by Apache upstream in version 1.21 (July 2021) through commits 80124dd9f and 2fe582582, which introduced IOUtils.readRange() to replace the dangerous \"allocate-then-fill\" pattern with a safe \"read-available-then-return-actual\" approach. The target version 1.25.0, onboarded by TuxCare, already contained these upstream fixes. All examined code paths (ArArchiveInputStream, ZipArchiveInputStream, SevenZFile, AsiExtraField) use the defensive IOUtils.readRange() pattern that prevents OOM attacks by allocating only what was actually read from the stream.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.21), NVD (>= 1.0, < 1.21), cve.org (<= 1.20), Snyk (>= 1.0, < 1.21).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-36090" }, "impact_statement": "CVE-2021-36090 is NOT present in commons-compress 1.25.0-tuxcare.1. The vulnerability (DoS via excessive memory allocation from untrusted length fields in ZIP archives) was fixed by Apache upstream in version 1.21 (July 2021) through commits 80124dd9f and 2fe582582, which introduced IOUtils.readRange() to replace the dangerous \"allocate-then-fill\" pattern with a safe \"read-available-then-return-actual\" approach. The target version 1.25.0, onboarded by TuxCare, already contained these upstream fixes. All examined code paths (ArArchiveInputStream, ZipArchiveInputStream, SevenZFile, AsiExtraField) use the defensive IOUtils.readRange() pattern that prevents OOM attacks by allocating only what was actually read from the stream.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.21), NVD (>= 1.0, < 1.21), cve.org (<= 1.20), Snyk (>= 1.0, < 1.21)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.commons/commons-compress@1.25.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.commons/commons-compress@1.25.0-tuxcare.1" } } ], "timestamp": "2026-11-03T12:24:19.585233+00:00", "status_notes": "Vulnerability CVE-2023-42503 does not affect version 1.25.0-tuxcare.1 of org.apache.commons:commons-compress. not_affected \u2014 Target version 1.25.0 is NOT vulnerable to CVE-2023-42503. The upstream fix for PAX time header validation was already present in Apache Commons Compress 1.25.0 when TuxCare onboarded it. The fix (commit 43354810a by Gary Gregory on 2023-09-03) adds regex validation to parseInstantFromDecimalSeconds() that limits integer and fractional parts to 19 digits each, preventing BigDecimal DoS attacks ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-42503" }, "impact_statement": "not_affected \u2014 Target version 1.25.0 is NOT vulnerable to CVE-2023-42503. The upstream fix for PAX time header validation was already present in Apache Commons Compress 1.25.0 when TuxCare onboarded it. The fix (commit 43354810a by Gary Gregory on 2023-09-03) adds regex validation to parseInstantFromDecimalSeconds() that limits integer and fractional parts to 19 digits each, preventing BigDecimal DoS attacks ..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.apache.commons/commons-compress@1.25.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.commons/commons-compress@1.25.0-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-25710 is fixed in version 1.25.0-tuxcare.1 of org.apache.commons:commons-compress.", "vulnerability": { "name": "CVE-2024-25710" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.commons/commons-compress@1.25.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.commons/commons-compress@1.25.0-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-26308 affects version 1.25.0-tuxcare.1 of org.apache.commons:commons-compress.", "vulnerability": { "name": "CVE-2024-26308" }, "action_statement": "Vulnerability CVE-2024-26308 affects version 1.25.0-tuxcare.1 of org.apache.commons:commons-compress." } ] }