{
  "@id": "urn:uuid:a1868d7f-4bb7-403c-9d6e-12e16e07dd1c",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 13,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-01T22:46:00.154236+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.kafka/connect-basic-auth-extension@2.8.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.kafka/connect-basic-auth-extension@2.8.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-31T14:28:11.229215+00:00",
      "status_notes": "Vulnerability CVE-2017-12610 does not affect version 2.8.2-tuxcare.6 of org.apache.kafka:connect-basic-auth-extension. not_affected \u2014 CVE-2017-12610 concerns SASL authentication impersonation in Apache Kafka where clients could specify an authorization ID different from their authenticated username. The vulnerability allowed authenticated clients to impersonate other users by crafting SASL/PLAIN or SASL/SCRAM messages with mismatched authorization and authentication IDs. The target repository (Kafka 2.8.2) is NOT AFFECTED bec...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-12610"
      },
      "impact_statement": "not_affected \u2014 CVE-2017-12610 concerns SASL authentication impersonation in Apache Kafka where clients could specify an authorization ID different from their authenticated username. The vulnerability allowed authenticated clients to impersonate other users by crafting SASL/PLAIN or SASL/SCRAM messages with mismatched authorization and authentication IDs. The target repository (Kafka 2.8.2) is NOT AFFECTED bec..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.kafka/connect-basic-auth-extension@2.8.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.kafka/connect-basic-auth-extension@2.8.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-31T09:10:00.186757+00:00",
      "status_notes": "Vulnerability CVE-2021-38153 does not affect version 2.8.2-tuxcare.6 of org.apache.kafka:connect-basic-auth-extension. not_affected \u2014 The target Apache Kafka 2.8.2 is not affected by CVE-2021-38153. The vulnerability involved timing attacks on password/key comparisons using Arrays.equals, which returns early on mismatch and leaks timing information. The fix (constant-time comparison via Utils.isEqualConstantTime and MessageDigest.isEqual) was introduced by upstream commit 3325342fecba56c2f5b28d60ca37605a7ebf420a on July 30, 2...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-38153"
      },
      "impact_statement": "not_affected \u2014 The target Apache Kafka 2.8.2 is not affected by CVE-2021-38153. The vulnerability involved timing attacks on password/key comparisons using Arrays.equals, which returns early on mismatch and leaks timing information. The fix (constant-time comparison via Utils.isEqualConstantTime and MessageDigest.isEqual) was introduced by upstream commit 3325342fecba56c2f5b28d60ca37605a7ebf420a on July 30, 2..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.kafka/connect-basic-auth-extension@2.8.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.kafka/connect-basic-auth-extension@2.8.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-21T15:25:42.568736+00:00",
      "status_notes": "Vulnerability CVE-2024-31141 affects version 2.8.2-tuxcare.6 of org.apache.kafka:connect-basic-auth-extension.",
      "vulnerability": {
        "name": "CVE-2024-31141"
      },
      "action_statement": "Vulnerability CVE-2024-31141 affects version 2.8.2-tuxcare.6 of org.apache.kafka:connect-basic-auth-extension."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.kafka/connect-basic-auth-extension@2.8.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.kafka/connect-basic-auth-extension@2.8.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-29T00:29:56.875680+00:00",
      "status_notes": "Vulnerability CVE-2025-27817 affects version 2.8.2-tuxcare.6 of org.apache.kafka:connect-basic-auth-extension.",
      "vulnerability": {
        "name": "CVE-2025-27817"
      },
      "action_statement": "Vulnerability CVE-2025-27817 affects version 2.8.2-tuxcare.6 of org.apache.kafka:connect-basic-auth-extension."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.kafka/connect-basic-auth-extension@2.8.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.kafka/connect-basic-auth-extension@2.8.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-28T17:02:22.125063+00:00",
      "status_notes": "Vulnerability CVE-2026-111551 affects version 2.8.2-tuxcare.6 of org.apache.kafka:connect-basic-auth-extension.",
      "vulnerability": {
        "name": "CVE-2026-111551"
      },
      "action_statement": "Vulnerability CVE-2026-111551 affects version 2.8.2-tuxcare.6 of org.apache.kafka:connect-basic-auth-extension."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.kafka/connect-basic-auth-extension@2.8.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.kafka/connect-basic-auth-extension@2.8.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-01T22:46:00.154236+00:00",
      "status_notes": "Vulnerability CVE-2026-33557 affects version 2.8.2-tuxcare.6 of org.apache.kafka:connect-basic-auth-extension.",
      "vulnerability": {
        "name": "CVE-2026-33557"
      },
      "action_statement": "Vulnerability CVE-2026-33557 affects version 2.8.2-tuxcare.6 of org.apache.kafka:connect-basic-auth-extension."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.kafka/connect-basic-auth-extension@2.8.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.kafka/connect-basic-auth-extension@2.8.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-21T15:25:42.568736+00:00",
      "status_notes": "Vulnerability CVE-2026-33558 affects version 2.8.2-tuxcare.6 of org.apache.kafka:connect-basic-auth-extension.",
      "vulnerability": {
        "name": "CVE-2026-33558"
      },
      "action_statement": "Vulnerability CVE-2026-33558 affects version 2.8.2-tuxcare.6 of org.apache.kafka:connect-basic-auth-extension."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.kafka/connect-basic-auth-extension@2.8.2-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.apache.kafka/connect-basic-auth-extension@2.8.2-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-21T15:25:42.568736+00:00",
      "status_notes": "Vulnerability CVE-2026-35554 affects version 2.8.2-tuxcare.6 of org.apache.kafka:connect-basic-auth-extension.",
      "vulnerability": {
        "name": "CVE-2026-35554"
      },
      "action_statement": "Vulnerability CVE-2026-35554 affects version 2.8.2-tuxcare.6 of org.apache.kafka:connect-basic-auth-extension."
    }
  ]
}