{
  "@id": "urn:uuid:005b47e5-9e26-41cf-942b-6347d86e124d",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 5,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:03:00.104314+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.commons/commons-configuration2@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.commons/commons-configuration2@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:03:00.104314+00:00",
      "status_notes": "Vulnerability CVE-2020-1953 does not affect version 2.11.0-tuxcare.1 of org.apache.commons:commons-configuration2. CVE-2020-1953 affects Apache Commons Configuration versions 2.2-2.6 where YAML parsing used SnakeYAML's unsafe default Constructor allowing arbitrary Java object instantiation. Target version 2.11.0 is NOT affected - it includes upstream fixes that replaced unsafe parsing with SafeConstructor (SnakeYAML's official safe parser) which explicitly blocks Java type tags and prevents arbitrary object instantiation. The vulnerable code pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.2, < 2.7), NVD (= 2.2; = 2.3; = 2.4; = 2.5; = 2.6), cve.org (= 2.2; = 2.3; = 2.4; = 2.5; = 2.6), Snyk (>= 2.2, < 2.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-1953"
      },
      "impact_statement": "CVE-2020-1953 affects Apache Commons Configuration versions 2.2-2.6 where YAML parsing used SnakeYAML's unsafe default Constructor allowing arbitrary Java object instantiation. Target version 2.11.0 is NOT affected - it includes upstream fixes that replaced unsafe parsing with SafeConstructor (SnakeYAML's official safe parser) which explicitly blocks Java type tags and prevents arbitrary object instantiation. The vulnerable code pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.2, < 2.7), NVD (= 2.2; = 2.3; = 2.4; = 2.5; = 2.6), cve.org (= 2.2; = 2.3; = 2.4; = 2.5; = 2.6), Snyk (>= 2.2, < 2.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.commons/commons-configuration2@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.commons/commons-configuration2@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:02:00.202619+00:00",
      "status_notes": "Vulnerability CVE-2022-33980 does not affect version 2.11.0-tuxcare.1 of org.apache.commons:commons-configuration2. CVE-2022-33980 fix was already present in Apache Commons Configuration 2.11.0 upstream release. The dangerous interpolation lookups (DNS, URL, SCRIPT) that could enable arbitrary code execution or remote server contact are excluded from the default set. The fix commit f025bc39 by Matt Juntunen (mattjuntunen@apache.org) was included in the upstream 2.11.0 release before TuxCare onboarded it. The target repository at version 2.11.0-tuxcare.1 contains the complete fix implementation where ConfigurationInterpolator.createDefaultLookups() explicitly excludes the three dangerous lookups, only including safe ones.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4, < 2.8.0), NVD (>= 2.4, < 2.8), cve.org (< 2.8.0), Snyk (>= 2.4, < 2.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-33980"
      },
      "impact_statement": "CVE-2022-33980 fix was already present in Apache Commons Configuration 2.11.0 upstream release. The dangerous interpolation lookups (DNS, URL, SCRIPT) that could enable arbitrary code execution or remote server contact are excluded from the default set. The fix commit f025bc39 by Matt Juntunen (mattjuntunen@apache.org) was included in the upstream 2.11.0 release before TuxCare onboarded it. The target repository at version 2.11.0-tuxcare.1 contains the complete fix implementation where ConfigurationInterpolator.createDefaultLookups() explicitly excludes the three dangerous lookups, only including safe ones.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4, < 2.8.0), NVD (>= 2.4, < 2.8), cve.org (< 2.8.0), Snyk (>= 2.4, < 2.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.commons/commons-configuration2@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.commons/commons-configuration2@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:02:00.202619+00:00",
      "status_notes": "Vulnerability CVE-2024-29131 does not affect version 2.11.0-tuxcare.1 of org.apache.commons:commons-configuration2. CVE-2024-29131 is not present in commons-configuration 2.11.0-tuxcare.1. The vulnerability (StackOverflowError from unbounded recursion in AbstractListDelimiterHandler.flattenIterator()) was fixed in upstream version 2.10.1 by Apache committer Gary Gregory. Both fix commits (56b5c4dc adding Path special-casing and 7d7d399d adding dejaVu circular-reference tracking) were already in the upstream 2.11.0 release that TuxCare onboarded. The target code contains both defense mechanisms: (1) Path objects are treated as terminal values instead of being iterated, and (2) visited objects are tracked using an IdentityHashMap-backed set to prevent circular reference loops. All delimiter handler implementations (DefaultListDelimiterHandler, LegacyListDelimiterHandler, DisabledListDelimiterHandler) extend AbstractListDelimiterHandler or use the interface's fixed default method, ensuring comprehensive coverage.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.10.1), NVD (>= 2.0, < 2.10.1), cve.org (>= 2.0, < 2.10.1; >= 2.0, < 2.10.1), Snyk (>= 2.0.0, < 2.10.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-29131"
      },
      "impact_statement": "CVE-2024-29131 is not present in commons-configuration 2.11.0-tuxcare.1. The vulnerability (StackOverflowError from unbounded recursion in AbstractListDelimiterHandler.flattenIterator()) was fixed in upstream version 2.10.1 by Apache committer Gary Gregory. Both fix commits (56b5c4dc adding Path special-casing and 7d7d399d adding dejaVu circular-reference tracking) were already in the upstream 2.11.0 release that TuxCare onboarded. The target code contains both defense mechanisms: (1) Path objects are treated as terminal values instead of being iterated, and (2) visited objects are tracked using an IdentityHashMap-backed set to prevent circular reference loops. All delimiter handler implementations (DefaultListDelimiterHandler, LegacyListDelimiterHandler, DisabledListDelimiterHandler) extend AbstractListDelimiterHandler or use the interface's fixed default method, ensuring comprehensive coverage.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.10.1), NVD (>= 2.0, < 2.10.1), cve.org (>= 2.0, < 2.10.1; >= 2.0, < 2.10.1), Snyk (>= 2.0.0, < 2.10.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.commons/commons-configuration2@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.commons/commons-configuration2@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T04:49:00.480244+00:00",
      "status_notes": "Vulnerability CVE-2024-29133 does not affect version 2.11.0-tuxcare.1 of org.apache.commons:commons-configuration2. not_affected \u2014 CVE-2024-29133 is NOT present in Apache Commons Configuration 2.11.0-tuxcare.1. The vulnerability (StackOverflowError when flattening cyclical object trees) was fixed by upstream maintainer Gary Gregory in commit 43f4dab0 and released in version 2.10.1. TuxCare onboarded version 2.11.0 which already contained this upstream fix. The vulnerable code pattern (pre-adding root value to cycle-detecti...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-29133"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-29133 is NOT present in Apache Commons Configuration 2.11.0-tuxcare.1. The vulnerability (StackOverflowError when flattening cyclical object trees) was fixed by upstream maintainer Gary Gregory in commit 43f4dab0 and released in version 2.10.1. TuxCare onboarded version 2.11.0 which already contained this upstream fix. The vulnerable code pattern (pre-adding root value to cycle-detecti..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.commons/commons-configuration2@2.11.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.commons/commons-configuration2@2.11.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-45205 is fixed in version 2.11.0-tuxcare.1 of org.apache.commons:commons-configuration2.",
      "vulnerability": {
        "name": "CVE-2026-45205"
      }
    }
  ]
}