{ "@id": "urn:uuid:92331c2b-01b8-4f1e-8e9b-bb369b5172af", "role": "Document Creator", "author": "https://tuxcare.com", "version": 29, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-12T05:32:00.110255+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf.karaf/apache-cxf@3.5.9-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.apache.cxf.karaf/apache-cxf@3.5.9-tuxcare.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2005-4838 does not affect version 3.5.9-tuxcare.7 of org.apache.cxf.karaf:apache-cxf. Patches already applied: f3932a9ab64689e354e9c36da95f001049fde13d (already in target via 6a984d1184f 'Adding a test for the service listing + private endpoints'); 576b9b55ff80b118bc16c33df755ae518ba5f13e (already in target via 1cf50e500c9 'Fixing issue with multiple forward slashes in services listing stylesheetPath')", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2005-4838" }, "impact_statement": "Patches already applied: f3932a9ab64689e354e9c36da95f001049fde13d (already in target via 6a984d1184f 'Adding a test for the service listing + private endpoints'); 576b9b55ff80b118bc16c33df755ae518ba5f13e (already in target via 1cf50e500c9 'Fixing issue with multiple forward slashes in services listing stylesheetPath')" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf.karaf/apache-cxf@3.5.9-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.apache.cxf.karaf/apache-cxf@3.5.9-tuxcare.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2007-1358 does not affect version 3.5.9-tuxcare.7 of org.apache.cxf.karaf:apache-cxf. All 1 patch commits already exist in target branch", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2007-1358" }, "impact_statement": "All 1 patch commits already exist in target branch" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf.karaf/apache-cxf@3.5.9-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.apache.cxf.karaf/apache-cxf@3.5.9-tuxcare.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2008-0128 is a false positive for org.apache.cxf.karaf:apache-cxf 3.5.9-tuxcare.7. false_positive \u2014 CVE-2008-0128 concerns Apache Tomcat's SingleSignOn valve (org.apache.catalina.authenticator.SingleSignOn) failing to set the secure flag on JSESSIONIDSSO cookies. This repository is Apache CXF 3.5.9-tuxcare.6, a web services framework that does not contain, vendor, or bundle any Tomcat code in its production distribution. Tomcat appears only as a test-scoped dependency for integration testing....", "vulnerability": { "name": "CVE-2008-0128" }, "impact_statement": "false_positive \u2014 CVE-2008-0128 concerns Apache Tomcat's SingleSignOn valve (org.apache.catalina.authenticator.SingleSignOn) failing to set the secure flag on JSESSIONIDSSO cookies. This repository is Apache CXF 3.5.9-tuxcare.6, a web services framework that does not contain, vendor, or bundle any Tomcat code in its production distribution. Tomcat appears only as a test-scoped dependency for integration testing...." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf.karaf/apache-cxf@3.5.9-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.apache.cxf.karaf/apache-cxf@3.5.9-tuxcare.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2009-2696 does not affect version 3.5.9-tuxcare.7 of org.apache.cxf.karaf:apache-cxf. Version 3.5.9 is not affected by CVE-2009-2696: the security fix is already present in the target branch. Momus prerequisite check: \"Patches already applied: f3932a9ab64689e354e9c36da95f001049fde13d, 576\". No backport needed.", "vulnerability": { "name": "CVE-2009-2696" }, "impact_statement": "Version 3.5.9 is not affected by CVE-2009-2696: the security fix is already present in the target branch. Momus prerequisite check: \"Patches already applied: f3932a9ab64689e354e9c36da95f001049fde13d, 576\". No backport needed." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf.karaf/apache-cxf@3.5.9-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.apache.cxf.karaf/apache-cxf@3.5.9-tuxcare.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2010-1151 is a false positive for org.apache.cxf.karaf:apache-cxf 3.5.9-tuxcare.7. false_positive \u2014 CVE-2010-1151 concerns mod_auth_shadow module for Apache HTTP Server, but this repository is Apache CXF (a Java web services framework). This is a wrong-project match - the affected component is completely absent from this repository.", "vulnerability": { "name": "CVE-2010-1151" }, "impact_statement": "false_positive \u2014 CVE-2010-1151 concerns mod_auth_shadow module for Apache HTTP Server, but this repository is Apache CXF (a Java web services framework). This is a wrong-project match - the affected component is completely absent from this repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf.karaf/apache-cxf@3.5.9-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.apache.cxf.karaf/apache-cxf@3.5.9-tuxcare.7" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2013-4444 is a false positive for org.apache.cxf.karaf:apache-cxf 3.5.9-tuxcare.7. direct vulnerability is in Apache Tomcat project", "vulnerability": { "name": "CVE-2013-4444" }, "impact_statement": "direct vulnerability is in Apache Tomcat project" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf.karaf/apache-cxf@3.5.9-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.apache.cxf.karaf/apache-cxf@3.5.9-tuxcare.7" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2013-6357 is a false positive for org.apache.cxf.karaf:apache-cxf 3.5.9-tuxcare.7. false_positive \u2014 CVE-2013-6357 is a wrong-project match. This repository is Apache CXF, a web services framework. The CVE concerns the Manager application in Apache Tomcat 5.5.25 and earlier, which is a completely different Apache project. The Tomcat Manager application and its vulnerable endpoints are not present in this repository.", "vulnerability": { "name": "CVE-2013-6357" }, "impact_statement": "false_positive \u2014 CVE-2013-6357 is a wrong-project match. This repository is Apache CXF, a web services framework. The CVE concerns the Manager application in Apache Tomcat 5.5.25 and earlier, which is a completely different Apache project. The Tomcat Manager application and its vulnerable endpoints are not present in this repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf.karaf/apache-cxf@3.5.9-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.apache.cxf.karaf/apache-cxf@3.5.9-tuxcare.7" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2014-0119 is a false positive for org.apache.cxf.karaf:apache-cxf 3.5.9-tuxcare.7. direct vulnerability is in Apache Tomcat project", "vulnerability": { "name": "CVE-2014-0119" }, "impact_statement": "direct vulnerability is in Apache Tomcat project" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf.karaf/apache-cxf@3.5.9-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.apache.cxf.karaf/apache-cxf@3.5.9-tuxcare.7" } } ], "timestamp": "2026-11-04T09:03:00.104314+00:00", "status_notes": "Vulnerability CVE-2017-3156 does not affect version 3.5.9-tuxcare.7 of org.apache.cxf.karaf:apache-cxf. CVE-2017-3156 affects Apache CXF versions using non-constant-time MAC signature comparison (Arrays.equals) in OAuth2 Hawk and JOSE validation, enabling timing attacks. The target (Apache CXF 3.5.9-tuxcare.10) uses MessageDigest.isEqual() for constant-time comparison in all three vulnerable locations (JWE authentication tag validation, JWS signature verification, Hawk MAC validation). The fix was applied by upstream Apache CXF author Sergey Beryozkin in commit e66ce235ee on 2016-12-30, predating the first TuxCare commit. The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.13; >= 3.1.0, < 3.1.10), NVD (<= 3.0.12; = 3.1.0; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.1.5; = 3.1.6; = 3.1.7; = 3.1.8; = 3.1.9), cve.org (< 3.0.13; >= 3.1, < 3.1.10), Snyk (<= 0; < 3.0.13; >= 3.1.0, < 3.1.10; <= 0; < 3.0.13; >= 3.1.0, < 3.1.10).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-3156" }, "impact_statement": "CVE-2017-3156 affects Apache CXF versions using non-constant-time MAC signature comparison (Arrays.equals) in OAuth2 Hawk and JOSE validation, enabling timing attacks. The target (Apache CXF 3.5.9-tuxcare.10) uses MessageDigest.isEqual() for constant-time comparison in all three vulnerable locations (JWE authentication tag validation, JWS signature verification, Hawk MAC validation). The fix was applied by upstream Apache CXF author Sergey Beryozkin in commit e66ce235ee on 2016-12-30, predating the first TuxCare commit. The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.13; >= 3.1.0, < 3.1.10), NVD (<= 3.0.12; = 3.1.0; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.1.5; = 3.1.6; = 3.1.7; = 3.1.8; = 3.1.9), cve.org (< 3.0.13; >= 3.1, < 3.1.10), Snyk (<= 0; < 3.0.13; >= 3.1.0, < 3.1.10; <= 0; < 3.0.13; >= 3.1.0, < 3.1.10)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf.karaf/apache-cxf@3.5.9-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.apache.cxf.karaf/apache-cxf@3.5.9-tuxcare.7" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2025-15104 is a false positive for org.apache.cxf.karaf:apache-cxf 3.5.9-tuxcare.7. direct vulnerability is in Nu Html Checker (validator.nu) project", "vulnerability": { "name": "CVE-2025-15104" }, "impact_statement": "direct vulnerability is in Nu Html Checker (validator.nu) project" } ] }