{ "@id": "urn:uuid:b5c70d67-fadc-40d1-85b0-1ab8bc83f2ee", "role": "Document Creator", "author": "https://tuxcare.com", "version": 29, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-12T02:46:00.035379+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf.karaf/apache-cxf@3.5.11-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.apache.cxf.karaf/apache-cxf@3.5.11-tuxcare.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2005-4838 is a false positive for org.apache.cxf.karaf:apache-cxf 3.5.11-tuxcare.4. false_positive \u2014 CVE-2005-4838 concerns XSS vulnerabilities in Jakarta Tomcat's example web applications (examples/jsp2/ directory). This repository is Apache CXF, a completely different Apache project. The affected Tomcat example applications are not present in this repository.", "vulnerability": { "name": "CVE-2005-4838" }, "impact_statement": "false_positive \u2014 CVE-2005-4838 concerns XSS vulnerabilities in Jakarta Tomcat's example web applications (examples/jsp2/ directory). This repository is Apache CXF, a completely different Apache project. The affected Tomcat example applications are not present in this repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf.karaf/apache-cxf@3.5.11-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.apache.cxf.karaf/apache-cxf@3.5.11-tuxcare.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2006-7196 is a false positive for org.apache.cxf.karaf:apache-cxf 3.5.11-tuxcare.4. false_positive \u2014 CVE-2006-7196 concerns Apache Tomcat's calendar example application (cal2.jsp), but this repository is Apache CXF, a completely different Apache project. This is a wrong-project match - the affected component is not present in this repository.", "vulnerability": { "name": "CVE-2006-7196" }, "impact_statement": "false_positive \u2014 CVE-2006-7196 concerns Apache Tomcat's calendar example application (cal2.jsp), but this repository is Apache CXF, a completely different Apache project. This is a wrong-project match - the affected component is not present in this repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf.karaf/apache-cxf@3.5.11-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.apache.cxf.karaf/apache-cxf@3.5.11-tuxcare.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2007-1358 is a false positive for org.apache.cxf.karaf:apache-cxf 3.5.11-tuxcare.4. false_positive \u2014 CVE-2007-1358 concerns Apache Tomcat 4.x, but this repository is Apache CXF (a web services framework). The CVE's affected product code is not present in this repository - Tomcat appears only as a test-scoped dependency. This is a wrong-project match.", "vulnerability": { "name": "CVE-2007-1358" }, "impact_statement": "false_positive \u2014 CVE-2007-1358 concerns Apache Tomcat 4.x, but this repository is Apache CXF (a web services framework). The CVE's affected product code is not present in this repository - Tomcat appears only as a test-scoped dependency. This is a wrong-project match." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf.karaf/apache-cxf@3.5.11-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.apache.cxf.karaf/apache-cxf@3.5.11-tuxcare.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2007-2449 is a false positive for org.apache.cxf.karaf:apache-cxf 3.5.11-tuxcare.4. false_positive \u2014 CVE-2007-2449 concerns Apache Tomcat's examples web application (specifically JSP files like snoop.jsp). The target repository is Apache CXF (org.apache.cxf), a different Apache project. Exhaustive containment search found no Tomcat examples web application - neither as the project itself, nor vendored/bundled, nor as a runtime dependency. Tomcat appears only as a test dependency. This is a wrong-project match.", "vulnerability": { "name": "CVE-2007-2449" }, "impact_statement": "false_positive \u2014 CVE-2007-2449 concerns Apache Tomcat's examples web application (specifically JSP files like snoop.jsp). The target repository is Apache CXF (org.apache.cxf), a different Apache project. Exhaustive containment search found no Tomcat examples web application - neither as the project itself, nor vendored/bundled, nor as a runtime dependency. Tomcat appears only as a test dependency. This is a wrong-project match." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf.karaf/apache-cxf@3.5.11-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.apache.cxf.karaf/apache-cxf@3.5.11-tuxcare.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2008-0128 does not affect version 3.5.11-tuxcare.4 of org.apache.cxf.karaf:apache-cxf. not_affected \u2014 CVE-2008-0128 targets Apache Tomcat's SingleSignOn Valve and JSESSIONIDSSO cookie. The target repository is Apache CXF (web services framework), which does not contain Tomcat's authentication infrastructure or SSO functionality.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2008-0128" }, "impact_statement": "not_affected \u2014 CVE-2008-0128 targets Apache Tomcat's SingleSignOn Valve and JSESSIONIDSSO cookie. The target repository is Apache CXF (web services framework), which does not contain Tomcat's authentication infrastructure or SSO functionality." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf.karaf/apache-cxf@3.5.11-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.apache.cxf.karaf/apache-cxf@3.5.11-tuxcare.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2009-2696 does not affect version 3.5.11-tuxcare.4 of org.apache.cxf.karaf:apache-cxf. Version 3.5.11 is not affected by CVE-2009-2696: the security fix is already present in the target branch. Momus prerequisite check: \"Patches already applied: f3932a9ab64689e354e9c36da95f001049fde13d, 576\". No backport needed.", "vulnerability": { "name": "CVE-2009-2696" }, "impact_statement": "Version 3.5.11 is not affected by CVE-2009-2696: the security fix is already present in the target branch. Momus prerequisite check: \"Patches already applied: f3932a9ab64689e354e9c36da95f001049fde13d, 576\". No backport needed." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf.karaf/apache-cxf@3.5.11-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.apache.cxf.karaf/apache-cxf@3.5.11-tuxcare.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2010-1151 is a false positive for org.apache.cxf.karaf:apache-cxf 3.5.11-tuxcare.4. false_positive \u2014 CVE-2010-1151 is a wrong-project match. The CVE concerns mod_auth_shadow for Apache HTTP Server (a C-based authentication module), not Apache CXF (a Java web services framework). No mod_auth_shadow code, dependencies, or related authentication patterns exist in this repository.", "vulnerability": { "name": "CVE-2010-1151" }, "impact_statement": "false_positive \u2014 CVE-2010-1151 is a wrong-project match. The CVE concerns mod_auth_shadow for Apache HTTP Server (a C-based authentication module), not Apache CXF (a Java web services framework). No mod_auth_shadow code, dependencies, or related authentication patterns exist in this repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf.karaf/apache-cxf@3.5.11-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.apache.cxf.karaf/apache-cxf@3.5.11-tuxcare.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2013-4286 is a false positive for org.apache.cxf.karaf:apache-cxf 3.5.11-tuxcare.4. false_positive \u2014 CVE-2013-4286 is a false positive for Apache CXF 3.5.11. The CVE concerns Apache Tomcat's servlet container (versions before 6.0.39, 7.x before 7.0.47, 8.x before 8.0.0-RC3) and its handling of inconsistent HTTP request headers leading to request smuggling. The target repository is Apache CXF, a web services framework that is a completely different project from Tomcat. CXF does not vendor or bu...", "vulnerability": { "name": "CVE-2013-4286" }, "impact_statement": "false_positive \u2014 CVE-2013-4286 is a false positive for Apache CXF 3.5.11. The CVE concerns Apache Tomcat's servlet container (versions before 6.0.39, 7.x before 7.0.47, 8.x before 8.0.0-RC3) and its handling of inconsistent HTTP request headers leading to request smuggling. The target repository is Apache CXF, a web services framework that is a completely different project from Tomcat. CXF does not vendor or bu..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf.karaf/apache-cxf@3.5.11-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.apache.cxf.karaf/apache-cxf@3.5.11-tuxcare.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2013-6357 is a false positive for org.apache.cxf.karaf:apache-cxf 3.5.11-tuxcare.4. false_positive \u2014 CVE-2013-6357 is a false positive match for this repository. The CVE concerns a CSRF vulnerability in Apache Tomcat's Manager web application (versions 5.5.25 and earlier), but this repository is Apache CXF version 3.5.11, a completely different Apache project. Apache CXF is a web services framework for building SOAP/REST services, not a servlet container or application server. The affected com...", "vulnerability": { "name": "CVE-2013-6357" }, "impact_statement": "false_positive \u2014 CVE-2013-6357 is a false positive match for this repository. The CVE concerns a CSRF vulnerability in Apache Tomcat's Manager web application (versions 5.5.25 and earlier), but this repository is Apache CXF version 3.5.11, a completely different Apache project. Apache CXF is a web services framework for building SOAP/REST services, not a servlet container or application server. The affected com..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.cxf.karaf/apache-cxf@3.5.11-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.apache.cxf.karaf/apache-cxf@3.5.11-tuxcare.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-0096 affects version 3.5.11-tuxcare.4 of org.apache.cxf.karaf:apache-cxf.", "vulnerability": { "name": "CVE-2014-0096" }, "action_statement": "Vulnerability CVE-2014-0096 affects version 3.5.11-tuxcare.4 of org.apache.cxf.karaf:apache-cxf." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf.karaf/apache-cxf@3.5.11-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.apache.cxf.karaf/apache-cxf@3.5.11-tuxcare.4" } } ], "timestamp": "2026-11-04T09:03:00.104314+00:00", "status_notes": "Vulnerability CVE-2017-3156 does not affect version 3.5.11-tuxcare.4 of org.apache.cxf.karaf:apache-cxf. CVE-2017-3156 is not present in this target. The vulnerability concerned timing attacks in MAC signature comparison using non-constant-time Arrays.equals(). The fix (replacing Arrays.equals with MessageDigest.isEqual for constant-time comparison) was committed by upstream Apache CXF developer Sergey Beryozkin on 2016-12-30 (commit e66ce235ee) and included in upstream tag cxf-3.5.11. TuxCare onboarded this version on 2025-12-09, nearly 9 years after the fix. All three affected files (AesCbcHmacJweDecryption.java, HmacJwsSignatureVerifier.java, AbstractHawkAccessTokenValidator.java) use the secure MessageDigest.isEqual method. The vulnerable code pattern was never present in the TuxCare-maintained version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.13; >= 3.1.0, < 3.1.10), NVD (<= 3.0.12; = 3.1.0; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.1.5; = 3.1.6; = 3.1.7; = 3.1.8; = 3.1.9), cve.org (< 3.0.13; >= 3.1, < 3.1.10), Snyk (<= 0; < 3.0.13; >= 3.1.0, < 3.1.10; <= 0; < 3.0.13; >= 3.1.0, < 3.1.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-3156" }, "impact_statement": "CVE-2017-3156 is not present in this target. The vulnerability concerned timing attacks in MAC signature comparison using non-constant-time Arrays.equals(). The fix (replacing Arrays.equals with MessageDigest.isEqual for constant-time comparison) was committed by upstream Apache CXF developer Sergey Beryozkin on 2016-12-30 (commit e66ce235ee) and included in upstream tag cxf-3.5.11. TuxCare onboarded this version on 2025-12-09, nearly 9 years after the fix. All three affected files (AesCbcHmacJweDecryption.java, HmacJwsSignatureVerifier.java, AbstractHawkAccessTokenValidator.java) use the secure MessageDigest.isEqual method. The vulnerable code pattern was never present in the TuxCare-maintained version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.13; >= 3.1.0, < 3.1.10), NVD (<= 3.0.12; = 3.1.0; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.1.5; = 3.1.6; = 3.1.7; = 3.1.8; = 3.1.9), cve.org (< 3.0.13; >= 3.1, < 3.1.10), Snyk (<= 0; < 3.0.13; >= 3.1.0, < 3.1.10; <= 0; < 3.0.13; >= 3.1.0, < 3.1.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf.karaf/apache-cxf@3.5.11-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.apache.cxf.karaf/apache-cxf@3.5.11-tuxcare.4" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2025-15104 is a false positive for org.apache.cxf.karaf:apache-cxf 3.5.11-tuxcare.4. direct vulnerability is in Nu Html Checker (validator.nu) project", "vulnerability": { "name": "CVE-2025-15104" }, "impact_statement": "direct vulnerability is in Nu Html Checker (validator.nu) project" } ] }