{
  "@id": "urn:uuid:393343c2-6d4a-4e59-b244-e634508328a9",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T14:25:11.684084+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf@3.0.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf@3.0.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T14:25:07.526701+00:00",
      "status_notes": "Vulnerability CVE-2012-0803 does not affect version 3.0.12-tuxcare.2 of org.apache.cxf:cxf. not_affected \u2014 Apache CXF 3.0.12 is not affected by CVE-2012-0803. The vulnerability, which allowed empty UsernameTokens to bypass authentication in CXF versions 2.4.5 and 2.5.1 (circa 2012), does not exist in version 3.0.12 (released December 2016). The target version uses WSS4J 2.0.10, which validates that UsernameTokens contain non-empty usernames and throws WSSecurityException when parsing tokens with mis...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2012-0803"
      },
      "impact_statement": "not_affected \u2014 Apache CXF 3.0.12 is not affected by CVE-2012-0803. The vulnerability, which allowed empty UsernameTokens to bypass authentication in CXF versions 2.4.5 and 2.5.1 (circa 2012), does not exist in version 3.0.12 (released December 2016). The target version uses WSS4J 2.0.10, which validates that UsernameTokens contain non-empty usernames and throws WSSecurityException when parsing tokens with mis..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf@3.0.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf@3.0.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T14:25:07.526701+00:00",
      "status_notes": "Vulnerability CVE-2012-2378 does not affect version 3.0.12-tuxcare.2 of org.apache.cxf:cxf. not_affected \u2014 Apache CXF 3.0.12 is not affected by CVE-2012-2378. The vulnerability affected versions 2.4.5-2.4.7, 2.5.1-2.5.3, and 2.6.x before 2.6.1, where child policies of WS-SecurityPolicy 1.1 SupportingToken (AlgorithmSuite, SignedParts, SignedElements, EncryptedParts, EncryptedElements) were not properly enforced on the client side. The fix was introduced in upstream commit 4500bf901c (May 14, 2012) b...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2012-2378"
      },
      "impact_statement": "not_affected \u2014 Apache CXF 3.0.12 is not affected by CVE-2012-2378. The vulnerability affected versions 2.4.5-2.4.7, 2.5.1-2.5.3, and 2.6.x before 2.6.1, where child policies of WS-SecurityPolicy 1.1 SupportingToken (AlgorithmSuite, SignedParts, SignedElements, EncryptedParts, EncryptedElements) were not properly enforced on the client side. The fix was introduced in upstream commit 4500bf901c (May 14, 2012) b..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf@3.0.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf@3.0.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T14:25:07.526701+00:00",
      "status_notes": "Vulnerability CVE-2012-2379 does not affect version 3.0.12-tuxcare.2 of org.apache.cxf:cxf. not_affected \u2014 Apache CXF 3.0.12 is not affected by CVE-2012-2379. The vulnerability affected versions 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, where Supporting Tokens with child WS-SecurityPolicy assertions did not properly validate that XML elements were signed or encrypted as required. The fix was applied by Apache CXF upstream on May 14, 2012 (commit 4500bf901c by Colm O Heigeartaig...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2012-2379"
      },
      "impact_statement": "not_affected \u2014 Apache CXF 3.0.12 is not affected by CVE-2012-2379. The vulnerability affected versions 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, where Supporting Tokens with child WS-SecurityPolicy assertions did not properly validate that XML elements were signed or encrypted as required. The fix was applied by Apache CXF upstream on May 14, 2012 (commit 4500bf901c by Colm O Heigeartaig..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf@3.0.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf@3.0.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T14:25:07.526701+00:00",
      "status_notes": "Vulnerability CVE-2012-3451 does not affect version 3.0.12-tuxcare.2 of org.apache.cxf:cxf. not_affected \u2014 Apache CXF 3.0.12 is not affected by CVE-2012-3451. The vulnerability allows attackers to execute unintended web-service operations by sending a SOAP Action header inconsistent with the message body. This was fixed in upstream commit 9c70abe28f (August 2, 2012) by Colm O Heigeartaigh, which added the SoapActionInAttemptTwoInterceptor to validate SOAP Action consistency and throw a SOAP_ACTION_M...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2012-3451"
      },
      "impact_statement": "not_affected \u2014 Apache CXF 3.0.12 is not affected by CVE-2012-3451. The vulnerability allows attackers to execute unintended web-service operations by sending a SOAP Action header inconsistent with the message body. This was fixed in upstream commit 9c70abe28f (August 2, 2012) by Colm O Heigeartaigh, which added the SoapActionInAttemptTwoInterceptor to validate SOAP Action consistency and throw a SOAP_ACTION_M..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf@3.0.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf@3.0.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T14:25:07.526701+00:00",
      "status_notes": "Vulnerability CVE-2012-5633 does not affect version 3.0.12-tuxcare.2 of org.apache.cxf:cxf. not_affected \u2014 Apache CXF version 3.0.12 is NOT affected by CVE-2012-5633. The vulnerable URIMappingInterceptor class, which allowed HTTP GET requests to bypass WS-Security processing, was completely removed from the codebase in commit fcc19c3ddd (January 2014) by Apache upstream developer Daniel Kulp. This fix was already present in the upstream release 3.0.12 that TuxCare onboarded. The vulnerable code patt...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2012-5633"
      },
      "impact_statement": "not_affected \u2014 Apache CXF version 3.0.12 is NOT affected by CVE-2012-5633. The vulnerable URIMappingInterceptor class, which allowed HTTP GET requests to bypass WS-Security processing, was completely removed from the codebase in commit fcc19c3ddd (January 2014) by Apache upstream developer Daniel Kulp. This fix was already present in the upstream release 3.0.12 that TuxCare onboarded. The vulnerable code patt..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf@3.0.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf@3.0.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T14:25:07.526701+00:00",
      "status_notes": "Vulnerability CVE-2019-12406 affects version 3.0.12-tuxcare.2 of org.apache.cxf:cxf.",
      "vulnerability": {
        "name": "CVE-2019-12406"
      },
      "action_statement": "Vulnerability CVE-2019-12406 affects version 3.0.12-tuxcare.2 of org.apache.cxf:cxf."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf@3.0.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf@3.0.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T14:25:11.684084+00:00",
      "status_notes": "Vulnerability CVE-2019-12419 is fixed in version 3.0.12-tuxcare.2 of org.apache.cxf:cxf.",
      "vulnerability": {
        "name": "CVE-2019-12419"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf@3.0.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf@3.0.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T14:25:07.526701+00:00",
      "status_notes": "Vulnerability CVE-2019-12423 affects version 3.0.12-tuxcare.2 of org.apache.cxf:cxf.",
      "vulnerability": {
        "name": "CVE-2019-12423"
      },
      "action_statement": "Vulnerability CVE-2019-12423 affects version 3.0.12-tuxcare.2 of org.apache.cxf:cxf."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf@3.0.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf@3.0.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T14:25:07.526701+00:00",
      "status_notes": "Vulnerability CVE-2019-17573 affects version 3.0.12-tuxcare.2 of org.apache.cxf:cxf.",
      "vulnerability": {
        "name": "CVE-2019-17573"
      },
      "action_statement": "Vulnerability CVE-2019-17573 affects version 3.0.12-tuxcare.2 of org.apache.cxf:cxf."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf@3.0.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf@3.0.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T14:25:07.526701+00:00",
      "status_notes": "Vulnerability CVE-2020-13954 affects version 3.0.12-tuxcare.2 of org.apache.cxf:cxf.",
      "vulnerability": {
        "name": "CVE-2020-13954"
      },
      "action_statement": "Vulnerability CVE-2020-13954 affects version 3.0.12-tuxcare.2 of org.apache.cxf:cxf."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf@3.0.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf@3.0.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T14:25:07.526701+00:00",
      "status_notes": "Vulnerability CVE-2021-22696 affects version 3.0.12-tuxcare.2 of org.apache.cxf:cxf.",
      "vulnerability": {
        "name": "CVE-2021-22696"
      },
      "action_statement": "Vulnerability CVE-2021-22696 affects version 3.0.12-tuxcare.2 of org.apache.cxf:cxf."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/cxf@3.0.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/cxf@3.0.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T14:25:07.526701+00:00",
      "status_notes": "Vulnerability CVE-2021-30468 affects version 3.0.12-tuxcare.2 of org.apache.cxf:cxf.",
      "vulnerability": {
        "name": "CVE-2021-30468"
      },
      "action_statement": "Vulnerability CVE-2021-30468 affects version 3.0.12-tuxcare.2 of org.apache.cxf:cxf."
    }
  ]
}