{ "@id": "urn:uuid:978a09e1-03d6-44a0-94cb-7cd0ea552ca7", "role": "Document Creator", "author": "https://tuxcare.com", "version": 18, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-12T05:32:00.110255+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf-runtime-javascript@3.5.9-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf-runtime-javascript@3.5.9-tuxcare.10" } } ], "timestamp": "2026-10-23T14:00:10.208616+00:00", "status_notes": "Vulnerability CVE-2005-4838 does not affect version 3.5.9-tuxcare.10 of org.apache.cxf:cxf-runtime-javascript. Patches already applied: f3932a9ab64689e354e9c36da95f001049fde13d (already in target via 6a984d1184f 'Adding a test for the service listing + private endpoints'); 576b9b55ff80b118bc16c33df755ae518ba5f13e (already in target via 1cf50e500c9 'Fixing issue with multiple forward slashes in services listing stylesheetPath')", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2005-4838" }, "impact_statement": "Patches already applied: f3932a9ab64689e354e9c36da95f001049fde13d (already in target via 6a984d1184f 'Adding a test for the service listing + private endpoints'); 576b9b55ff80b118bc16c33df755ae518ba5f13e (already in target via 1cf50e500c9 'Fixing issue with multiple forward slashes in services listing stylesheetPath')" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf-runtime-javascript@3.5.9-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf-runtime-javascript@3.5.9-tuxcare.10" } } ], "timestamp": "2026-10-23T14:00:10.208616+00:00", "status_notes": "Vulnerability CVE-2007-1358 does not affect version 3.5.9-tuxcare.10 of org.apache.cxf:cxf-runtime-javascript. All 1 patch commits already exist in target branch", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2007-1358" }, "impact_statement": "All 1 patch commits already exist in target branch" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf-runtime-javascript@3.5.9-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf-runtime-javascript@3.5.9-tuxcare.10" } } ], "timestamp": "2026-10-23T14:00:10.208616+00:00", "status_notes": "Vulnerability CVE-2008-0128 is a false positive for org.apache.cxf:cxf-runtime-javascript 3.5.9-tuxcare.10. false_positive \u2014 CVE-2008-0128 concerns Apache Tomcat's SingleSignOn valve (org.apache.catalina.authenticator.SingleSignOn) failing to set the secure flag on JSESSIONIDSSO cookies. This repository is Apache CXF 3.5.9-tuxcare.6, a web services framework that does not contain, vendor, or bundle any Tomcat code in its production distribution. Tomcat appears only as a test-scoped dependency for integration testing....", "vulnerability": { "name": "CVE-2008-0128" }, "impact_statement": "false_positive \u2014 CVE-2008-0128 concerns Apache Tomcat's SingleSignOn valve (org.apache.catalina.authenticator.SingleSignOn) failing to set the secure flag on JSESSIONIDSSO cookies. This repository is Apache CXF 3.5.9-tuxcare.6, a web services framework that does not contain, vendor, or bundle any Tomcat code in its production distribution. Tomcat appears only as a test-scoped dependency for integration testing...." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf-runtime-javascript@3.5.9-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf-runtime-javascript@3.5.9-tuxcare.10" } } ], "timestamp": "2026-10-23T14:00:10.208616+00:00", "status_notes": "Vulnerability CVE-2009-2696 does not affect version 3.5.9-tuxcare.10 of org.apache.cxf:cxf-runtime-javascript. Version 3.5.9 is not affected by CVE-2009-2696: the security fix is already present in the target branch. Momus prerequisite check: \"Patches already applied: f3932a9ab64689e354e9c36da95f001049fde13d, 576\". No backport needed.", "vulnerability": { "name": "CVE-2009-2696" }, "impact_statement": "Version 3.5.9 is not affected by CVE-2009-2696: the security fix is already present in the target branch. Momus prerequisite check: \"Patches already applied: f3932a9ab64689e354e9c36da95f001049fde13d, 576\". No backport needed." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf-runtime-javascript@3.5.9-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf-runtime-javascript@3.5.9-tuxcare.10" } } ], "timestamp": "2026-10-23T14:00:10.208616+00:00", "status_notes": "Vulnerability CVE-2010-1151 is a false positive for org.apache.cxf:cxf-runtime-javascript 3.5.9-tuxcare.10. false_positive \u2014 CVE-2010-1151 concerns mod_auth_shadow module for Apache HTTP Server, but this repository is Apache CXF (a Java web services framework). This is a wrong-project match - the affected component is completely absent from this repository.", "vulnerability": { "name": "CVE-2010-1151" }, "impact_statement": "false_positive \u2014 CVE-2010-1151 concerns mod_auth_shadow module for Apache HTTP Server, but this repository is Apache CXF (a Java web services framework). This is a wrong-project match - the affected component is completely absent from this repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf-runtime-javascript@3.5.9-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf-runtime-javascript@3.5.9-tuxcare.10" } } ], "timestamp": "2026-10-23T14:00:10.208616+00:00", "status_notes": "Vulnerability CVE-2013-4444 is a false positive for org.apache.cxf:cxf-runtime-javascript 3.5.9-tuxcare.10. direct vulnerability is in Apache Tomcat project", "vulnerability": { "name": "CVE-2013-4444" }, "impact_statement": "direct vulnerability is in Apache Tomcat project" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf-runtime-javascript@3.5.9-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf-runtime-javascript@3.5.9-tuxcare.10" } } ], "timestamp": "2026-10-23T14:00:10.208616+00:00", "status_notes": "Vulnerability CVE-2013-6357 is a false positive for org.apache.cxf:cxf-runtime-javascript 3.5.9-tuxcare.10. false_positive \u2014 CVE-2013-6357 is a wrong-project match. This repository is Apache CXF, a web services framework. The CVE concerns the Manager application in Apache Tomcat 5.5.25 and earlier, which is a completely different Apache project. The Tomcat Manager application and its vulnerable endpoints are not present in this repository.", "vulnerability": { "name": "CVE-2013-6357" }, "impact_statement": "false_positive \u2014 CVE-2013-6357 is a wrong-project match. This repository is Apache CXF, a web services framework. The CVE concerns the Manager application in Apache Tomcat 5.5.25 and earlier, which is a completely different Apache project. The Tomcat Manager application and its vulnerable endpoints are not present in this repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf-runtime-javascript@3.5.9-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf-runtime-javascript@3.5.9-tuxcare.10" } } ], "timestamp": "2026-10-23T14:00:10.208616+00:00", "status_notes": "Vulnerability CVE-2014-0119 is a false positive for org.apache.cxf:cxf-runtime-javascript 3.5.9-tuxcare.10. direct vulnerability is in Apache Tomcat project", "vulnerability": { "name": "CVE-2014-0119" }, "impact_statement": "direct vulnerability is in Apache Tomcat project" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf-runtime-javascript@3.5.9-tuxcare.10", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf-runtime-javascript@3.5.9-tuxcare.10" } } ], "timestamp": "2026-10-23T14:00:10.208616+00:00", "status_notes": "Vulnerability CVE-2025-15104 is a false positive for org.apache.cxf:cxf-runtime-javascript 3.5.9-tuxcare.10. direct vulnerability is in Nu Html Checker (validator.nu) project", "vulnerability": { "name": "CVE-2025-15104" }, "impact_statement": "direct vulnerability is in Nu Html Checker (validator.nu) project" } ] }