{ "@id": "urn:uuid:efcbe591-58eb-4c58-bd6a-89be9a53f802", "role": "Document Creator", "author": "https://tuxcare.com", "version": 1, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-07T00:41:35.685763+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.4.5-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.4.5-tuxcare.2" } } ], "timestamp": "2026-11-07T00:41:35.685763+00:00", "status_notes": "Vulnerability CVE-2012-0803 does not affect version 3.4.5-tuxcare.2 of org.apache.cxf:cxf. not_affected \u2014 CVE-2012-0803 affects Apache CXF versions 2.4.5 and 2.5.1, allowing authentication bypass via empty UsernameToken in WS-Security policy validation. The target is Apache CXF 3.4.5, released approximately 9 years after the vulnerable versions. The vulnerability was fixed by upstream Apache CXF between version 2.5.1 and 3.4.5, and the fix was included in the upstream 3.4.5 release that TuxCare onb...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2012-0803" }, "impact_statement": "not_affected \u2014 CVE-2012-0803 affects Apache CXF versions 2.4.5 and 2.5.1, allowing authentication bypass via empty UsernameToken in WS-Security policy validation. The target is Apache CXF 3.4.5, released approximately 9 years after the vulnerable versions. The vulnerability was fixed by upstream Apache CXF between version 2.5.1 and 3.4.5, and the fix was included in the upstream 3.4.5 release that TuxCare onb..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.4.5-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.4.5-tuxcare.2" } } ], "timestamp": "2026-11-07T00:41:35.685763+00:00", "status_notes": "Vulnerability CVE-2012-2378 does not affect version 3.4.5-tuxcare.2 of org.apache.cxf:cxf. Version 3.4.5 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-vjpc-vf4f-82qg (affected below 2.6.1), NVD (affected up to 2.6.0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2012-2378" }, "impact_statement": "Version 3.4.5 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-vjpc-vf4f-82qg (affected below 2.6.1), NVD (affected up to 2.6.0)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.4.5-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.4.5-tuxcare.2" } } ], "timestamp": "2026-11-07T00:41:35.685763+00:00", "status_notes": "Vulnerability CVE-2012-2379 does not affect version 3.4.5-tuxcare.2 of org.apache.cxf:cxf. not_affected \u2014 Apache CXF version 3.4.5 is not affected by CVE-2012-2379. The vulnerability affected versions 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1. The fix was introduced in upstream commit 4500bf901c (May 2012) and is present in the 3.4.5 release. The code now properly validates child WS-SecurityPolicy assertions (SignedParts, EncryptedParts, SignedElements, EncryptedElements) withi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2012-2379" }, "impact_statement": "not_affected \u2014 Apache CXF version 3.4.5 is not affected by CVE-2012-2379. The vulnerability affected versions 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1. The fix was introduced in upstream commit 4500bf901c (May 2012) and is present in the 3.4.5 release. The code now properly validates child WS-SecurityPolicy assertions (SignedParts, EncryptedParts, SignedElements, EncryptedElements) withi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.4.5-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.4.5-tuxcare.2" } } ], "timestamp": "2026-11-07T00:41:35.685763+00:00", "status_notes": "Vulnerability CVE-2012-3451 does not affect version 3.4.5-tuxcare.2 of org.apache.cxf:cxf. not_affected \u2014 CVE-2012-3451 allows attackers to execute unintended web-service operations by sending a SOAPAction header inconsistent with the message body. The vulnerability was fixed in upstream Apache CXF commit 9c70abe28f (August 2, 2012) by adding SoapActionInAttemptTwoInterceptor that validates SOAPAction matches the operation determined from the message body. Target version 3.4.5 includes this upstrea...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2012-3451" }, "impact_statement": "not_affected \u2014 CVE-2012-3451 allows attackers to execute unintended web-service operations by sending a SOAPAction header inconsistent with the message body. The vulnerability was fixed in upstream Apache CXF commit 9c70abe28f (August 2, 2012) by adding SoapActionInAttemptTwoInterceptor that validates SOAPAction matches the operation determined from the message body. Target version 3.4.5 includes this upstrea..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.4.5-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.4.5-tuxcare.2" } } ], "timestamp": "2026-11-07T00:41:35.685763+00:00", "status_notes": "Vulnerability CVE-2012-5633 does not affect version 3.4.5-tuxcare.2 of org.apache.cxf:cxf. not_affected \u2014 Apache CXF 3.4.5 is NOT affected by CVE-2012-5633. The vulnerable component (URIMappingInterceptor) was completely removed from the codebase in January 2014 (commit fcc19c3ddd) by upstream Apache developers due to security concerns. The fix was already present in the Apache CXF 3.4.5 release that TuxCare onboarded in April 2026. The vulnerability allowed HTTP GET requests to bypass WS-Security ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2012-5633" }, "impact_statement": "not_affected \u2014 Apache CXF 3.4.5 is NOT affected by CVE-2012-5633. The vulnerable component (URIMappingInterceptor) was completely removed from the codebase in January 2014 (commit fcc19c3ddd) by upstream Apache developers due to security concerns. The fix was already present in the Apache CXF 3.4.5 release that TuxCare onboarded in April 2026. The vulnerability allowed HTTP GET requests to bypass WS-Security ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.4.5-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.4.5-tuxcare.2" } } ], "timestamp": "2026-11-07T00:41:35.685763+00:00", "status_notes": "Vulnerability CVE-2019-12406 does not affect version 3.4.5-tuxcare.2 of org.apache.cxf:cxf. not_affected \u2014 CVE-2019-12406 is NOT present in Apache CXF 3.4.5-tuxcare.1. The fix for this vulnerability was already included in the upstream Apache CXF 3.4.5 release (committed 2019-09-03 by Apache committer coheigea@apache.org) before TuxCare onboarded the version. The target code contains the complete mitigation: AttachmentDeserializer passes a configurable maxCount (default 50) to LazyAttachmentCollecti...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12406" }, "impact_statement": "not_affected \u2014 CVE-2019-12406 is NOT present in Apache CXF 3.4.5-tuxcare.1. The fix for this vulnerability was already included in the upstream Apache CXF 3.4.5 release (committed 2019-09-03 by Apache committer coheigea@apache.org) before TuxCare onboarded the version. The target code contains the complete mitigation: AttachmentDeserializer passes a configurable maxCount (default 50) to LazyAttachmentCollecti..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.4.5-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.4.5-tuxcare.2" } } ], "timestamp": "2026-11-07T00:41:35.685763+00:00", "status_notes": "Vulnerability CVE-2019-12419 does not affect version 3.4.5-tuxcare.2 of org.apache.cxf:cxf. CVE-2019-12419 is NOT present in the target. The vulnerability required missing validation that the authenticated principal matches the client_id parameter in OAuth token requests. The security fix (commit 337609d81a) was already included in the upstream Apache CXF 3.4.5 release, authored by Colm O hEigeartaigh (coheigea@apache.org). The fix validates principal-to-clientId matching and rejects mismatched requests via reportInvalidClient(). This fix shipped in the upstream release before TuxCare's onboarding commit b4e3552acd.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.11; >= 3.3.0, < 3.3.4), NVD (>= 3.2.0, < 3.2.11; >= 3.3.0, < 3.3.4), cve.org (< 3.3.4; < 3.2.11), Snyk (>= 3.3.0, < 3.3.4; >= 3.2.0, < 3.2.11).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12419" }, "impact_statement": "CVE-2019-12419 is NOT present in the target. The vulnerability required missing validation that the authenticated principal matches the client_id parameter in OAuth token requests. The security fix (commit 337609d81a) was already included in the upstream Apache CXF 3.4.5 release, authored by Colm O hEigeartaigh (coheigea@apache.org). The fix validates principal-to-clientId matching and rejects mismatched requests via reportInvalidClient(). This fix shipped in the upstream release before TuxCare's onboarding commit b4e3552acd.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.11; >= 3.3.0, < 3.3.4), NVD (>= 3.2.0, < 3.2.11; >= 3.3.0, < 3.3.4), cve.org (< 3.3.4; < 3.2.11), Snyk (>= 3.3.0, < 3.3.4; >= 3.2.0, < 3.2.11)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.4.5-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.4.5-tuxcare.2" } } ], "timestamp": "2026-11-07T00:41:35.685763+00:00", "status_notes": "Vulnerability CVE-2019-12423 does not affect version 3.4.5-tuxcare.2 of org.apache.cxf:cxf. CVE-2019-12423 affects Apache CXF's OpenId Connect JWK Keys service, which could expose private keys and secret keys when using JWK keystores. The vulnerability was fixed in upstream Apache CXF commit 6852cd5e4927f8e651c0a0589b5ee3f61e753186 (2019-11-14) by Colm O hEigeartaigh. This fix was included in the Apache CXF 3.4.5 upstream release (2021-09-29), which TuxCare onboarded on 2026-04-10. Therefore, the target repository at version 3.4.5 already contains the upstream fix and is not vulnerable. The defense code (stripPrivateParameters method, loadPublicVerificationKeys with stripping enabled by default, and JwksService with stripPrivateParameters=true) is present and active in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.12; >= 3.3.0, < 3.3.5; < 3.2.12; >= 3.3.0, < 3.3.5), NVD (< 3.2.12; >= 3.3.0, < 3.3.5), cve.org (< 3.3.5; < 3.2.12), Snyk (< 3.2.12; >= 3.3.0, < 3.3.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12423" }, "impact_statement": "CVE-2019-12423 affects Apache CXF's OpenId Connect JWK Keys service, which could expose private keys and secret keys when using JWK keystores. The vulnerability was fixed in upstream Apache CXF commit 6852cd5e4927f8e651c0a0589b5ee3f61e753186 (2019-11-14) by Colm O hEigeartaigh. This fix was included in the Apache CXF 3.4.5 upstream release (2021-09-29), which TuxCare onboarded on 2026-04-10. Therefore, the target repository at version 3.4.5 already contains the upstream fix and is not vulnerable. The defense code (stripPrivateParameters method, loadPublicVerificationKeys with stripping enabled by default, and JwksService with stripPrivateParameters=true) is present and active in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.12; >= 3.3.0, < 3.3.5; < 3.2.12; >= 3.3.0, < 3.3.5), NVD (< 3.2.12; >= 3.3.0, < 3.3.5), cve.org (< 3.3.5; < 3.2.12), Snyk (< 3.2.12; >= 3.3.0, < 3.3.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.4.5-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.4.5-tuxcare.2" } } ], "timestamp": "2026-11-07T00:41:35.685763+00:00", "status_notes": "Vulnerability CVE-2019-17573 does not affect version 3.4.5-tuxcare.2 of org.apache.cxf:cxf. not_affected \u2014 CVE-2019-17573 is NOT present in the target. The XSS vulnerability in the service listing page has been fixed by HTML-escaping URLs before output. The fix (commit 4ca5f7b921) was authored by Apache developer Colm O hEigeartaigh on 2019-12-18 and was already included in the upstream Apache CXF 3.4.5 release before TuxCare onboarded it on 2026-04-10. Both FormattedServiceListWriter and Unformatte...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17573" }, "impact_statement": "not_affected \u2014 CVE-2019-17573 is NOT present in the target. The XSS vulnerability in the service listing page has been fixed by HTML-escaping URLs before output. The fix (commit 4ca5f7b921) was authored by Apache developer Colm O hEigeartaigh on 2019-12-18 and was already included in the upstream Apache CXF 3.4.5 release before TuxCare onboarded it on 2026-04-10. Both FormattedServiceListWriter and Unformatte..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.4.5-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.4.5-tuxcare.2" } } ], "timestamp": "2026-11-07T00:41:35.685763+00:00", "status_notes": "Vulnerability CVE-2020-13954 does not affect version 3.4.5-tuxcare.2 of org.apache.cxf:cxf. not_affected \u2014 CVE-2020-13954 affects Apache CXF versions prior to 3.4.1 and 3.3.8. The target is Apache CXF 3.4.5-tuxcare.1, which already contains the upstream fix. The vulnerable code pattern (unescaped styleSheetPath rendering) is not present in this version because HTML escaping was added in the upstream 3.4.5 release before TuxCare onboarding.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-13954" }, "impact_statement": "not_affected \u2014 CVE-2020-13954 affects Apache CXF versions prior to 3.4.1 and 3.3.8. The target is Apache CXF 3.4.5-tuxcare.1, which already contains the upstream fix. The vulnerable code pattern (unescaped styleSheetPath rendering) is not present in this version because HTML escaping was added in the upstream 3.4.5 release before TuxCare onboarding." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.4.5-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.4.5-tuxcare.2" } } ], "timestamp": "2026-11-07T00:41:35.685763+00:00", "status_notes": "Vulnerability CVE-2021-22696 does not affect version 3.4.5-tuxcare.2 of org.apache.cxf:cxf. CVE-2021-22696 is NOT present in Apache CXF 3.4.5. The vulnerability affected versions prior to 3.4.3, and version 3.4.5 includes the upstream fix that disables request_uri support by default. The fix commits (7d5d2c7a and aee3bf291a) authored by the upstream Apache maintainer are present in HEAD and were shipped as part of the upstream 3.4.5 release, prior to TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.4.0, < 3.4.3; < 3.3.10; >= 3.4.0, < 3.4.3; < 3.3.10), NVD (< 3.3.10; >= 3.4.0, < 3.4.3), cve.org (< 3.4.3; < 3.3.10), Snyk (< 3.3.10; >= 3.4.0, < 3.4.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-22696" }, "impact_statement": "CVE-2021-22696 is NOT present in Apache CXF 3.4.5. The vulnerability affected versions prior to 3.4.3, and version 3.4.5 includes the upstream fix that disables request_uri support by default. The fix commits (7d5d2c7a and aee3bf291a) authored by the upstream Apache maintainer are present in HEAD and were shipped as part of the upstream 3.4.5 release, prior to TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.4.0, < 3.4.3; < 3.3.10; >= 3.4.0, < 3.4.3; < 3.3.10), NVD (< 3.3.10; >= 3.4.0, < 3.4.3), cve.org (< 3.4.3; < 3.3.10), Snyk (< 3.3.10; >= 3.4.0, < 3.4.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.4.5-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.4.5-tuxcare.2" } } ], "timestamp": "2026-11-07T00:41:35.685763+00:00", "status_notes": "Vulnerability CVE-2021-30468 does not affect version 3.4.5-tuxcare.2 of org.apache.cxf:cxf. The target Apache CXF 3.4.5 repository is not affected by CVE-2021-30468. The vulnerability (unescaped double quotes in JSON strings causing malformed JSON that triggers infinite parsing loops and CPU exhaustion) was fixed in upstream commit 9d423d4ceb by Apache developer Colm O hEigeartaigh. This fix was already present in the Apache CXF 3.4.5 release that TuxCare onboarded. The target code contains the escapeJson() method and properly escapes both map keys and string values before JSON serialization, preventing the vulnerable pattern from manifesting.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.4.0, < 3.4.4; < 3.3.11; >= 3.4.0, < 3.4.4; < 3.3.11), NVD (< 3.3.11; >= 3.4.0, < 3.4.4), cve.org (< 3.3.11), Snyk (>= 3.4.0, < 3.4.4; < 3.3.11).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-30468" }, "impact_statement": "The target Apache CXF 3.4.5 repository is not affected by CVE-2021-30468. The vulnerability (unescaped double quotes in JSON strings causing malformed JSON that triggers infinite parsing loops and CPU exhaustion) was fixed in upstream commit 9d423d4ceb by Apache developer Colm O hEigeartaigh. This fix was already present in the Apache CXF 3.4.5 release that TuxCare onboarded. The target code contains the escapeJson() method and properly escapes both map keys and string values before JSON serialization, preventing the vulnerable pattern from manifesting.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.4.0, < 3.4.4; < 3.3.11; >= 3.4.0, < 3.4.4; < 3.3.11), NVD (< 3.3.11; >= 3.4.0, < 3.4.4), cve.org (< 3.3.11), Snyk (>= 3.4.0, < 3.4.4; < 3.3.11)." } ] }