{
  "@id": "urn:uuid:0cd1c5ef-03dc-440a-b2eb-449f3d9ab9b8",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:51:00.040518+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/cookie@0.5.0",
          "identifiers": {
            "purl": "pkg:npm/cookie@0.5.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2017-18589 is a false positive for cookie 0.5.0. false_positive \u2014 CVE-2017-18589 is a wrong-project match. The CVE affects the Rust crate 'cookie-rs' by SergioBenitez, but the target repository is the JavaScript package 'cookie' from jshttp. These are completely separate implementations in different languages by different authors, sharing only the problem domain (HTTP cookie handling).",
      "vulnerability": {
        "name": "CVE-2017-18589"
      },
      "impact_statement": "false_positive \u2014 CVE-2017-18589 is a wrong-project match. The CVE affects the Rust crate 'cookie-rs' by SergioBenitez, but the target repository is the JavaScript package 'cookie' from jshttp. These are completely separate implementations in different languages by different authors, sharing only the problem domain (HTTP cookie handling)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/cookie@0.5.0",
          "identifiers": {
            "purl": "pkg:npm/cookie@0.5.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-47764 affects version 0.5.0 of cookie, and is fixed in 0.5.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2024-47764"
      },
      "action_statement": "Vulnerability CVE-2024-47764 affects version 0.5.0 of cookie, and is fixed in 0.5.0-tuxcare.1."
    }
  ]
}