{ "@id": "urn:uuid:52c03232-8b33-4ddd-8d93-36644d6544b6", "role": "Document Creator", "author": "https://tuxcare.com", "version": 33, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-12T02:46:00.035379+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.5.11-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.5.11-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2005-4838 is a false positive for org.apache.cxf:cxf 3.5.11-tuxcare.2. false_positive \u2014 CVE-2005-4838 concerns XSS vulnerabilities in Jakarta Tomcat's example web applications (examples/jsp2/ directory). This repository is Apache CXF, a completely different Apache project. The affected Tomcat example applications are not present in this repository.", "vulnerability": { "name": "CVE-2005-4838" }, "impact_statement": "false_positive \u2014 CVE-2005-4838 concerns XSS vulnerabilities in Jakarta Tomcat's example web applications (examples/jsp2/ directory). This repository is Apache CXF, a completely different Apache project. The affected Tomcat example applications are not present in this repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.5.11-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.5.11-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2006-7196 is a false positive for org.apache.cxf:cxf 3.5.11-tuxcare.2. false_positive \u2014 CVE-2006-7196 concerns Apache Tomcat's calendar example application (cal2.jsp), but this repository is Apache CXF, a completely different Apache project. This is a wrong-project match - the affected component is not present in this repository.", "vulnerability": { "name": "CVE-2006-7196" }, "impact_statement": "false_positive \u2014 CVE-2006-7196 concerns Apache Tomcat's calendar example application (cal2.jsp), but this repository is Apache CXF, a completely different Apache project. This is a wrong-project match - the affected component is not present in this repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.5.11-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.5.11-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2007-1358 is a false positive for org.apache.cxf:cxf 3.5.11-tuxcare.2. false_positive \u2014 CVE-2007-1358 concerns Apache Tomcat 4.x, but this repository is Apache CXF (a web services framework). The CVE's affected product code is not present in this repository - Tomcat appears only as a test-scoped dependency. This is a wrong-project match.", "vulnerability": { "name": "CVE-2007-1358" }, "impact_statement": "false_positive \u2014 CVE-2007-1358 concerns Apache Tomcat 4.x, but this repository is Apache CXF (a web services framework). The CVE's affected product code is not present in this repository - Tomcat appears only as a test-scoped dependency. This is a wrong-project match." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.5.11-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.5.11-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2007-2449 is a false positive for org.apache.cxf:cxf 3.5.11-tuxcare.2. false_positive \u2014 CVE-2007-2449 concerns Apache Tomcat's examples web application (specifically JSP files like snoop.jsp). The target repository is Apache CXF (org.apache.cxf), a different Apache project. Exhaustive containment search found no Tomcat examples web application - neither as the project itself, nor vendored/bundled, nor as a runtime dependency. Tomcat appears only as a test dependency. This is a wrong-project match.", "vulnerability": { "name": "CVE-2007-2449" }, "impact_statement": "false_positive \u2014 CVE-2007-2449 concerns Apache Tomcat's examples web application (specifically JSP files like snoop.jsp). The target repository is Apache CXF (org.apache.cxf), a different Apache project. Exhaustive containment search found no Tomcat examples web application - neither as the project itself, nor vendored/bundled, nor as a runtime dependency. Tomcat appears only as a test dependency. This is a wrong-project match." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.5.11-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.5.11-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2008-0128 does not affect version 3.5.11-tuxcare.2 of org.apache.cxf:cxf. not_affected \u2014 CVE-2008-0128 targets Apache Tomcat's SingleSignOn Valve and JSESSIONIDSSO cookie. The target repository is Apache CXF (web services framework), which does not contain Tomcat's authentication infrastructure or SSO functionality.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2008-0128" }, "impact_statement": "not_affected \u2014 CVE-2008-0128 targets Apache Tomcat's SingleSignOn Valve and JSESSIONIDSSO cookie. The target repository is Apache CXF (web services framework), which does not contain Tomcat's authentication infrastructure or SSO functionality." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.5.11-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.5.11-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2009-2696 does not affect version 3.5.11-tuxcare.2 of org.apache.cxf:cxf. Version 3.5.11 is not affected by CVE-2009-2696: the security fix is already present in the target branch. Momus prerequisite check: \"Patches already applied: f3932a9ab64689e354e9c36da95f001049fde13d, 576\". No backport needed.", "vulnerability": { "name": "CVE-2009-2696" }, "impact_statement": "Version 3.5.11 is not affected by CVE-2009-2696: the security fix is already present in the target branch. Momus prerequisite check: \"Patches already applied: f3932a9ab64689e354e9c36da95f001049fde13d, 576\". No backport needed." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.5.11-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.5.11-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2010-1151 is a false positive for org.apache.cxf:cxf 3.5.11-tuxcare.2. false_positive \u2014 CVE-2010-1151 is a wrong-project match. The CVE concerns mod_auth_shadow for Apache HTTP Server (a C-based authentication module), not Apache CXF (a Java web services framework). No mod_auth_shadow code, dependencies, or related authentication patterns exist in this repository.", "vulnerability": { "name": "CVE-2010-1151" }, "impact_statement": "false_positive \u2014 CVE-2010-1151 is a wrong-project match. The CVE concerns mod_auth_shadow for Apache HTTP Server (a C-based authentication module), not Apache CXF (a Java web services framework). No mod_auth_shadow code, dependencies, or related authentication patterns exist in this repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.5.11-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.5.11-tuxcare.2" } } ], "timestamp": "2026-11-03T16:17:04.637381+00:00", "status_notes": "Vulnerability CVE-2012-0803 does not affect version 3.5.11-tuxcare.2 of org.apache.cxf:cxf. not_affected \u2014 CVE-2012-0803 affects Apache CXF 2.4.5 and 2.5.1, allowing authentication bypass via empty UsernameToken. Target version 3.5.11-tuxcare.10 contains upstream fix commit b77e43f19d (2017-04-04) that addresses this vulnerability by rejecting UsernameTokens with no password by default. The fix operates at two layers: (1) security context creation skips UT_NOPASSWORD tokens unless explicitly enabled...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2012-0803" }, "impact_statement": "not_affected \u2014 CVE-2012-0803 affects Apache CXF 2.4.5 and 2.5.1, allowing authentication bypass via empty UsernameToken. Target version 3.5.11-tuxcare.10 contains upstream fix commit b77e43f19d (2017-04-04) that addresses this vulnerability by rejecting UsernameTokens with no password by default. The fix operates at two layers: (1) security context creation skips UT_NOPASSWORD tokens unless explicitly enabled..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.5.11-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.5.11-tuxcare.2" } } ], "timestamp": "2026-11-05T14:19:54.137004+00:00", "status_notes": "Vulnerability CVE-2012-2378 does not affect version 3.5.11-tuxcare.2 of org.apache.cxf:cxf. Version 3.5.11 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-vjpc-vf4f-82qg (affected below 2.6.1), NVD (affected up to 2.6.0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2012-2378" }, "impact_statement": "Version 3.5.11 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-vjpc-vf4f-82qg (affected below 2.6.1), NVD (affected up to 2.6.0)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.5.11-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.5.11-tuxcare.2" } } ], "timestamp": "2026-11-03T16:18:43.675482+00:00", "status_notes": "Vulnerability CVE-2012-2379 does not affect version 3.5.11-tuxcare.2 of org.apache.cxf:cxf. not_affected \u2014 CVE-2012-2379 affects Apache CXF versions 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1. The target version 3.5.11-tuxcare.10 is not affected because the vulnerability was fixed in upstream Apache CXF in May 2012 (commit 4500bf901c) and this fix was already present in the upstream release when TuxCare started maintaining version 3.5.11. The fix adds comprehensive validation of ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2012-2379" }, "impact_statement": "not_affected \u2014 CVE-2012-2379 affects Apache CXF versions 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1. The target version 3.5.11-tuxcare.10 is not affected because the vulnerability was fixed in upstream Apache CXF in May 2012 (commit 4500bf901c) and this fix was already present in the upstream release when TuxCare started maintaining version 3.5.11. The fix adds comprehensive validation of ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.5.11-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.5.11-tuxcare.2" } } ], "timestamp": "2026-11-03T16:08:45.993587+00:00", "status_notes": "Vulnerability CVE-2012-3451 does not affect version 3.5.11-tuxcare.2 of org.apache.cxf:cxf. not_affected \u2014 CVE-2012-3451 is NOT present in Apache CXF 3.5.11. The vulnerability allowed attackers to execute unintended web-service operations by sending a SOAP Action header inconsistent with the message body. This was fixed in upstream commit b563f7b59d (March 2020) by Daniel Kulp, which added validation in RPCInInterceptor to verify SOAP Action matches the message body operation. The fix was already pr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2012-3451" }, "impact_statement": "not_affected \u2014 CVE-2012-3451 is NOT present in Apache CXF 3.5.11. The vulnerability allowed attackers to execute unintended web-service operations by sending a SOAP Action header inconsistent with the message body. This was fixed in upstream commit b563f7b59d (March 2020) by Daniel Kulp, which added validation in RPCInInterceptor to verify SOAP Action matches the message body operation. The fix was already pr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.5.11-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.5.11-tuxcare.2" } } ], "timestamp": "2026-11-03T16:16:13.062310+00:00", "status_notes": "Vulnerability CVE-2012-5633 does not affect version 3.5.11-tuxcare.2 of org.apache.cxf:cxf. not_affected \u2014 CVE-2012-5633 is not present in Apache CXF 3.5.11. The vulnerable component (URIMappingInterceptor) that allowed bypassing WS-Security processing via HTTP GET requests has been completely removed from the codebase. The fix was authored by upstream Apache (Daniel Kulp) and shipped in the upstream release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2012-5633" }, "impact_statement": "not_affected \u2014 CVE-2012-5633 is not present in Apache CXF 3.5.11. The vulnerable component (URIMappingInterceptor) that allowed bypassing WS-Security processing via HTTP GET requests has been completely removed from the codebase. The fix was authored by upstream Apache (Daniel Kulp) and shipped in the upstream release that TuxCare onboarded." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.5.11-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.5.11-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2013-4286 is a false positive for org.apache.cxf:cxf 3.5.11-tuxcare.2. false_positive \u2014 CVE-2013-4286 is a false positive for Apache CXF 3.5.11. The CVE concerns Apache Tomcat's servlet container (versions before 6.0.39, 7.x before 7.0.47, 8.x before 8.0.0-RC3) and its handling of inconsistent HTTP request headers leading to request smuggling. The target repository is Apache CXF, a web services framework that is a completely different project from Tomcat. CXF does not vendor or bu...", "vulnerability": { "name": "CVE-2013-4286" }, "impact_statement": "false_positive \u2014 CVE-2013-4286 is a false positive for Apache CXF 3.5.11. The CVE concerns Apache Tomcat's servlet container (versions before 6.0.39, 7.x before 7.0.47, 8.x before 8.0.0-RC3) and its handling of inconsistent HTTP request headers leading to request smuggling. The target repository is Apache CXF, a web services framework that is a completely different project from Tomcat. CXF does not vendor or bu..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.5.11-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.5.11-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2013-6357 is a false positive for org.apache.cxf:cxf 3.5.11-tuxcare.2. false_positive \u2014 CVE-2013-6357 is a false positive match for this repository. The CVE concerns a CSRF vulnerability in Apache Tomcat's Manager web application (versions 5.5.25 and earlier), but this repository is Apache CXF version 3.5.11, a completely different Apache project. Apache CXF is a web services framework for building SOAP/REST services, not a servlet container or application server. The affected com...", "vulnerability": { "name": "CVE-2013-6357" }, "impact_statement": "false_positive \u2014 CVE-2013-6357 is a false positive match for this repository. The CVE concerns a CSRF vulnerability in Apache Tomcat's Manager web application (versions 5.5.25 and earlier), but this repository is Apache CXF version 3.5.11, a completely different Apache project. Apache CXF is a web services framework for building SOAP/REST services, not a servlet container or application server. The affected com..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.5.11-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.5.11-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2014-0096 affects version 3.5.11-tuxcare.2 of org.apache.cxf:cxf.", "vulnerability": { "name": "CVE-2014-0096" }, "action_statement": "Vulnerability CVE-2014-0096 affects version 3.5.11-tuxcare.2 of org.apache.cxf:cxf." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.5.11-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.5.11-tuxcare.2" } } ], "timestamp": "2026-11-02T17:35:00.444343+00:00", "status_notes": "Vulnerability CVE-2019-12406 does not affect version 3.5.11-tuxcare.2 of org.apache.cxf:cxf. not_affected \u2014 CVE-2019-12406 is NOT present in Apache CXF 3.5.11-tuxcare.10. The vulnerability (unbounded attachment count causing DoS) was fixed in upstream Apache CXF 3.3.4/3.2.11 by commit 6c3990144b (author: coheigea@apache.org). This fix was already present in the upstream release 3.5.11 that TuxCare onboarded, before any TuxCare modifications. The target contains the complete defense: ATTACHMENT_MAX_CO...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12406" }, "impact_statement": "not_affected \u2014 CVE-2019-12406 is NOT present in Apache CXF 3.5.11-tuxcare.10. The vulnerability (unbounded attachment count causing DoS) was fixed in upstream Apache CXF 3.3.4/3.2.11 by commit 6c3990144b (author: coheigea@apache.org). This fix was already present in the upstream release 3.5.11 that TuxCare onboarded, before any TuxCare modifications. The target contains the complete defense: ATTACHMENT_MAX_CO..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.5.11-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.5.11-tuxcare.2" } } ], "timestamp": "2026-11-04T09:04:11.456857+00:00", "status_notes": "Vulnerability CVE-2019-12419 does not affect version 3.5.11-tuxcare.2 of org.apache.cxf:cxf. CVE-2019-12419 is NOT present in Apache CXF 3.5.11-tuxcare.10. The fix was already included in the upstream Apache CXF 3.5.11 release, shipped before TuxCare onboarding. The vulnerable pattern (allowing OAuth2 clients to obtain access tokens for other clients by exploiting missing principal-clientId validation) has been fixed at AbstractTokenService.java lines 81-83, which validates that authenticated principal matches the supplied client_id parameter and rejects mismatches with reportInvalidClient().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.11; >= 3.3.0, < 3.3.4), NVD (>= 3.2.0, < 3.2.11; >= 3.3.0, < 3.3.4), cve.org (< 3.3.4; < 3.2.11), Snyk (>= 3.3.0, < 3.3.4; >= 3.2.0, < 3.2.11).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12419" }, "impact_statement": "CVE-2019-12419 is NOT present in Apache CXF 3.5.11-tuxcare.10. The fix was already included in the upstream Apache CXF 3.5.11 release, shipped before TuxCare onboarding. The vulnerable pattern (allowing OAuth2 clients to obtain access tokens for other clients by exploiting missing principal-clientId validation) has been fixed at AbstractTokenService.java lines 81-83, which validates that authenticated principal matches the supplied client_id parameter and rejects mismatches with reportInvalidClient().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.11; >= 3.3.0, < 3.3.4), NVD (>= 3.2.0, < 3.2.11; >= 3.3.0, < 3.3.4), cve.org (< 3.3.4; < 3.2.11), Snyk (>= 3.3.0, < 3.3.4; >= 3.2.0, < 3.2.11)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.5.11-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.5.11-tuxcare.2" } } ], "timestamp": "2026-11-04T09:03:00.104314+00:00", "status_notes": "Vulnerability CVE-2019-12423 does not affect version 3.5.11-tuxcare.2 of org.apache.cxf:cxf. CVE-2019-12423 is not present in Apache CXF 3.5.11-tuxcare.10. The vulnerability, which exposed private key parameters and secret keys through the OpenId Connect JWK Keys service when using JWK keystores, was fixed in upstream commit 6852cd5e49 by Apache developer Colm O hEigeartaigh (coheigea@apache.org). This fix was already present in the upstream Apache CXF 3.5.11 release that TuxCare onboarded, as confirmed by ancestry analysis showing the fix commit predates the first TuxCare commit (b7acdd8c72). The fix adds mandatory stripping of RSA/EC private key parameters (d, p, q, dp, dq, qi) and complete exclusion of secret keys (oct type) from the JWK Keys service response through JwkUtils.stripPrivateParameters(), which is enabled by default (stripPrivateParameters=true in JwksService).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.12; >= 3.3.0, < 3.3.5; < 3.2.12; >= 3.3.0, < 3.3.5), NVD (< 3.2.12; >= 3.3.0, < 3.3.5), cve.org (< 3.3.5; < 3.2.12), Snyk (< 3.2.12; >= 3.3.0, < 3.3.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12423" }, "impact_statement": "CVE-2019-12423 is not present in Apache CXF 3.5.11-tuxcare.10. The vulnerability, which exposed private key parameters and secret keys through the OpenId Connect JWK Keys service when using JWK keystores, was fixed in upstream commit 6852cd5e49 by Apache developer Colm O hEigeartaigh (coheigea@apache.org). This fix was already present in the upstream Apache CXF 3.5.11 release that TuxCare onboarded, as confirmed by ancestry analysis showing the fix commit predates the first TuxCare commit (b7acdd8c72). The fix adds mandatory stripping of RSA/EC private key parameters (d, p, q, dp, dq, qi) and complete exclusion of secret keys (oct type) from the JWK Keys service response through JwkUtils.stripPrivateParameters(), which is enabled by default (stripPrivateParameters=true in JwksService).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.12; >= 3.3.0, < 3.3.5; < 3.2.12; >= 3.3.0, < 3.3.5), NVD (< 3.2.12; >= 3.3.0, < 3.3.5), cve.org (< 3.3.5; < 3.2.12), Snyk (< 3.2.12; >= 3.3.0, < 3.3.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.5.11-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.5.11-tuxcare.2" } } ], "timestamp": "2026-11-02T17:34:00.131982+00:00", "status_notes": "Vulnerability CVE-2019-17573 does not affect version 3.5.11-tuxcare.2 of org.apache.cxf:cxf. not_affected \u2014 CVE-2019-17573 is NOT present in Apache CXF 3.5.11-tuxcare.10. The reflected XSS vulnerability in the /services listing page was fixed in upstream Apache CXF and the fix was already present in the 3.5.11 release that TuxCare onboarded. The fix (commit ebf621e8b4) adds HTML entity escaping via StringEscapeUtils.escapeHtml4() to all endpoint URLs before they are written to the HTML services listi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17573" }, "impact_statement": "not_affected \u2014 CVE-2019-17573 is NOT present in Apache CXF 3.5.11-tuxcare.10. The reflected XSS vulnerability in the /services listing page was fixed in upstream Apache CXF and the fix was already present in the 3.5.11 release that TuxCare onboarded. The fix (commit ebf621e8b4) adds HTML entity escaping via StringEscapeUtils.escapeHtml4() to all endpoint URLs before they are written to the HTML services listi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.5.11-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.5.11-tuxcare.2" } } ], "timestamp": "2026-11-02T17:32:17.496522+00:00", "status_notes": "Vulnerability CVE-2020-13954 does not affect version 3.5.11-tuxcare.2 of org.apache.cxf:cxf. not_affected \u2014 The target Apache CXF 3.5.11-tuxcare.10 is not affected by CVE-2020-13954 (reflected XSS via styleSheetPath parameter). The upstream fix (commit 3c23fa3b3c by Colm O hEigeartaigh, dated Sep 23, 2020) was already present in the Apache CXF 3.5.11 release that TuxCare onboarded. The fix applies HTML escaping using StringEscapeUtils.escapeHtml4() to the styleSheetPath parameter in FormattedServiceL...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-13954" }, "impact_statement": "not_affected \u2014 The target Apache CXF 3.5.11-tuxcare.10 is not affected by CVE-2020-13954 (reflected XSS via styleSheetPath parameter). The upstream fix (commit 3c23fa3b3c by Colm O hEigeartaigh, dated Sep 23, 2020) was already present in the Apache CXF 3.5.11 release that TuxCare onboarded. The fix applies HTML escaping using StringEscapeUtils.escapeHtml4() to the styleSheetPath parameter in FormattedServiceL..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.5.11-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.5.11-tuxcare.2" } } ], "timestamp": "2026-11-04T09:04:11.456857+00:00", "status_notes": "Vulnerability CVE-2021-22696 does not affect version 3.5.11-tuxcare.2 of org.apache.cxf:cxf. CVE-2021-22696 is NOT present in Apache CXF 3.5.11-tuxcare.10. The vulnerability concerns insufficient validation of the OAuth 2.0 request_uri parameter, allowing attackers to trigger SSRF/DDoS by causing the authorization server to make outbound requests to arbitrary HTTPS URLs. The upstream fix (commits 40503a53 and aa789c5c by coheigea@apache.org on 2021-01-06) is present in HEAD: isRequestUriValid() returns false by default (disabling request_uri), and a SecurityException is thrown if both request and request_uri parameters are specified. These fixes were already in the upstream 3.5.11 release tag when TuxCare onboarded this version on 2025-12-09, confirmed by verifying both commits are ancestors of the first TuxCare commit b7acdd8c72.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.4.0, < 3.4.3; < 3.3.10; >= 3.4.0, < 3.4.3; < 3.3.10), NVD (< 3.3.10; >= 3.4.0, < 3.4.3), cve.org (< 3.4.3; < 3.3.10), Snyk (< 3.3.10; >= 3.4.0, < 3.4.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-22696" }, "impact_statement": "CVE-2021-22696 is NOT present in Apache CXF 3.5.11-tuxcare.10. The vulnerability concerns insufficient validation of the OAuth 2.0 request_uri parameter, allowing attackers to trigger SSRF/DDoS by causing the authorization server to make outbound requests to arbitrary HTTPS URLs. The upstream fix (commits 40503a53 and aa789c5c by coheigea@apache.org on 2021-01-06) is present in HEAD: isRequestUriValid() returns false by default (disabling request_uri), and a SecurityException is thrown if both request and request_uri parameters are specified. These fixes were already in the upstream 3.5.11 release tag when TuxCare onboarded this version on 2025-12-09, confirmed by verifying both commits are ancestors of the first TuxCare commit b7acdd8c72.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.4.0, < 3.4.3; < 3.3.10; >= 3.4.0, < 3.4.3; < 3.3.10), NVD (< 3.3.10; >= 3.4.0, < 3.4.3), cve.org (< 3.4.3; < 3.3.10), Snyk (< 3.3.10; >= 3.4.0, < 3.4.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.5.11-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.5.11-tuxcare.2" } } ], "timestamp": "2026-11-04T09:03:00.104314+00:00", "status_notes": "Vulnerability CVE-2021-30468 does not affect version 3.5.11-tuxcare.2 of org.apache.cxf:cxf. CVE-2021-30468 is NOT present in Apache CXF 3.5.11-tuxcare.10. The vulnerability involved missing JSON escaping in JsonMapObjectReaderWriter, allowing malformed JSON with unescaped quotes to cause infinite loops during parsing. The fix (commit fa01cfac79, CXF-8435) was applied by Apache upstream on May 28, 2021, adding an escapeJson() method that escapes double quotes and backslashes before JSON output. This fix was already present in the upstream Apache CXF 3.5.11 release that TuxCare onboarded in December 2025, over 4 years after the fix. The target additionally includes a June 2021 improvement (commit f01fd3146d, CXF-8555) with more sophisticated escaping logic. Lines 93 and 134 of JsonMapObjectReaderWriter.java confirm proper escaping on all output paths.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.4.0, < 3.4.4; < 3.3.11; >= 3.4.0, < 3.4.4; < 3.3.11), NVD (< 3.3.11; >= 3.4.0, < 3.4.4), cve.org (< 3.3.11), Snyk (>= 3.4.0, < 3.4.4; < 3.3.11).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-30468" }, "impact_statement": "CVE-2021-30468 is NOT present in Apache CXF 3.5.11-tuxcare.10. The vulnerability involved missing JSON escaping in JsonMapObjectReaderWriter, allowing malformed JSON with unescaped quotes to cause infinite loops during parsing. The fix (commit fa01cfac79, CXF-8435) was applied by Apache upstream on May 28, 2021, adding an escapeJson() method that escapes double quotes and backslashes before JSON output. This fix was already present in the upstream Apache CXF 3.5.11 release that TuxCare onboarded in December 2025, over 4 years after the fix. The target additionally includes a June 2021 improvement (commit f01fd3146d, CXF-8555) with more sophisticated escaping logic. Lines 93 and 134 of JsonMapObjectReaderWriter.java confirm proper escaping on all output paths.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.4.0, < 3.4.4; < 3.3.11; >= 3.4.0, < 3.4.4; < 3.3.11), NVD (< 3.3.11; >= 3.4.0, < 3.4.4), cve.org (< 3.3.11), Snyk (>= 3.4.0, < 3.4.4; < 3.3.11)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/cxf@3.5.11-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.apache.cxf/cxf@3.5.11-tuxcare.2" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2025-15104 is a false positive for org.apache.cxf:cxf 3.5.11-tuxcare.2. direct vulnerability is in Nu Html Checker (validator.nu) project", "vulnerability": { "name": "CVE-2025-15104" }, "impact_statement": "direct vulnerability is in Nu Html Checker (validator.nu) project" } ] }