{
  "@id": "urn:uuid:9bbbf769-eb79-44f7-bd0c-7e2eed0fab5e",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 15,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-01T22:46:00.154236+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.kafka/connect-basic-auth-extension@3.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.kafka/connect-basic-auth-extension@3.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T14:28:57.705054+00:00",
      "status_notes": "Vulnerability CVE-2017-12610 does not affect version 3.7.1-tuxcare.2 of org.apache.kafka:connect-basic-auth-extension. not_affected \u2014 CVE-2017-12610 does not affect Apache Kafka 3.7.1. The vulnerability (SASL authorization ID impersonation) was fixed in August 2017 by commit 47c2753496, which added validation to reject authentication attempts where the client-requested authorization ID differs from the authenticated username. This fix was present in all upstream Kafka releases from 1.0.0 onwards and was already in the 3.7.1 r...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-12610"
      },
      "impact_statement": "not_affected \u2014 CVE-2017-12610 does not affect Apache Kafka 3.7.1. The vulnerability (SASL authorization ID impersonation) was fixed in August 2017 by commit 47c2753496, which added validation to reject authentication attempts where the client-requested authorization ID differs from the authenticated username. This fix was present in all upstream Kafka releases from 1.0.0 onwards and was already in the 3.7.1 r..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.kafka/connect-basic-auth-extension@3.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.kafka/connect-basic-auth-extension@3.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T09:11:00.112798+00:00",
      "status_notes": "Vulnerability CVE-2021-38153 does not affect version 3.7.1-tuxcare.2 of org.apache.kafka:connect-basic-auth-extension. not_affected \u2014 Apache Kafka 3.7.1 is not affected by CVE-2021-38153. The timing attack vulnerability has been fixed in the upstream release. All password and cryptographic key comparisons in production code use constant-time algorithms (Utils.isEqualConstantTime() for char arrays and MessageDigest.isEqual() for byte arrays) instead of the vulnerable Arrays.equals() method. The fix was authored by upstream Apa...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-38153"
      },
      "impact_statement": "not_affected \u2014 Apache Kafka 3.7.1 is not affected by CVE-2021-38153. The timing attack vulnerability has been fixed in the upstream release. All password and cryptographic key comparisons in production code use constant-time algorithms (Utils.isEqualConstantTime() for char arrays and MessageDigest.isEqual() for byte arrays) instead of the vulnerable Arrays.equals() method. The fix was authored by upstream Apa..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.kafka/connect-basic-auth-extension@3.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.kafka/connect-basic-auth-extension@3.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T09:09:00.150777+00:00",
      "status_notes": "Vulnerability CVE-2024-31141 does not affect version 3.7.1-tuxcare.2 of org.apache.kafka:connect-basic-auth-extension. not_affected \u2014 The target Apache Kafka 3.7.1-tuxcare.2 is not affected by CVE-2024-31141. The vulnerability pattern (unrestricted ConfigProvider instantiation allowing arbitrary file/environment variable access) is not present because the upstream fix was already included in Apache Kafka 3.7.1 release. The fix adds a system property filter (org.apache.kafka.automatic.config.providers) in AbstractConfig.java t...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-31141"
      },
      "impact_statement": "not_affected \u2014 The target Apache Kafka 3.7.1-tuxcare.2 is not affected by CVE-2024-31141. The vulnerability pattern (unrestricted ConfigProvider instantiation allowing arbitrary file/environment variable access) is not present because the upstream fix was already included in Apache Kafka 3.7.1 release. The fix adds a system property filter (org.apache.kafka.automatic.config.providers) in AbstractConfig.java t..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.kafka/connect-basic-auth-extension@3.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.kafka/connect-basic-auth-extension@3.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-30T22:06:52.046727+00:00",
      "status_notes": "Vulnerability CVE-2025-27817 is fixed in version 3.7.1-tuxcare.2 of org.apache.kafka:connect-basic-auth-extension.",
      "vulnerability": {
        "name": "CVE-2025-27817"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.kafka/connect-basic-auth-extension@3.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.kafka/connect-basic-auth-extension@3.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T17:02:22.125063+00:00",
      "status_notes": "Vulnerability CVE-2026-111551 affects version 3.7.1-tuxcare.2 of org.apache.kafka:connect-basic-auth-extension.",
      "vulnerability": {
        "name": "CVE-2026-111551"
      },
      "action_statement": "Vulnerability CVE-2026-111551 affects version 3.7.1-tuxcare.2 of org.apache.kafka:connect-basic-auth-extension."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.kafka/connect-basic-auth-extension@3.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.kafka/connect-basic-auth-extension@3.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T22:46:00.154236+00:00",
      "status_notes": "Vulnerability CVE-2026-33557 affects version 3.7.1-tuxcare.2 of org.apache.kafka:connect-basic-auth-extension.",
      "vulnerability": {
        "name": "CVE-2026-33557"
      },
      "action_statement": "Vulnerability CVE-2026-33557 affects version 3.7.1-tuxcare.2 of org.apache.kafka:connect-basic-auth-extension."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.kafka/connect-basic-auth-extension@3.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.kafka/connect-basic-auth-extension@3.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-30T22:06:52.046727+00:00",
      "status_notes": "Vulnerability CVE-2026-33558 is fixed in version 3.7.1-tuxcare.2 of org.apache.kafka:connect-basic-auth-extension.",
      "vulnerability": {
        "name": "CVE-2026-33558"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.kafka/connect-basic-auth-extension@3.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.kafka/connect-basic-auth-extension@3.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-30T22:06:52.046727+00:00",
      "status_notes": "Vulnerability CVE-2026-35554 affects version 3.7.1-tuxcare.2 of org.apache.kafka:connect-basic-auth-extension.",
      "vulnerability": {
        "name": "CVE-2026-35554"
      },
      "action_statement": "Vulnerability CVE-2026-35554 affects version 3.7.1-tuxcare.2 of org.apache.kafka:connect-basic-auth-extension."
    }
  ]
}