{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:20d608fb-7b48-5ffb-98ac-b9a32517eba5", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "apache-artemis", "purl": "pkg:maven/org.apache.activemq/apache-artemis@2.33.0-tuxcare.9", "type": "library", "group": "org.apache.activemq", "bom-ref": "pkg:maven/org.apache.activemq/apache-artemis@2.33.0-tuxcare.9", "version": "2.33.0-tuxcare.9", "pedigree": { "ancestors": [ { "name": "apache-artemis", "purl": "pkg:maven/org.apache.activemq/apache-artemis@2.33.0", "type": "library", "group": "org.apache.activemq", "version": "2.33.0" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2011-4905", "affects": [ { "ref": "pkg:maven/org.apache.activemq/apache-artemis@2.33.0-tuxcare.9" } ], "bom-ref": "urn:uuid:1e6c7d79-38b2-5ba5-bf9d-815e0c024a81", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2011-4905 does not affect version 2.33.0-tuxcare.9 of org.apache.activemq:apache-artemis. Version 2.33.0 is not affected by CVE-2011-4905: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed." } }, { "id": "CVE-2018-8909", "affects": [ { "ref": "pkg:maven/org.apache.activemq/apache-artemis@2.33.0-tuxcare.9" } ], "bom-ref": "urn:uuid:af2fe44a-dbf7-54cd-8c86-28f310a39add", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2018-8909 is a false positive for org.apache.activemq:apache-artemis 2.33.0-tuxcare.9. false_positive \u2014 CVE-2018-8909 concerns the Wire application for Android, which is a completely different product from the target repository (Apache ActiveMQ Artemis). The affected component AssetService.scala and all Wire application code are absent from this repository. This is a wrong-project match." } }, { "id": "CVE-2020-13932", "affects": [ { "ref": "pkg:maven/org.apache.activemq/apache-artemis@2.33.0-tuxcare.9" } ], "bom-ref": "urn:uuid:1a4c3dfc-8b8f-52c5-8ad0-a5d65fe70ed0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-13932 does not affect version 2.33.0-tuxcare.9 of org.apache.activemq:apache-artemis. not_affected \u2014 CVE-2020-13932 XSS vulnerability was fixed in upstream Apache Artemis commit a69b2aee7b (ARTEMIS-2836) by gary.tully@gmail.com. This fix was already present in the upstream 2.33.0 release before TuxCare onboarded it (first TuxCare commit: 411448d398 \"Onboard version 2.33.0\"). The vulnerable code pattern (unescaped user input in HTML contexts) is not present in the target because the upstream fi...", "justification": "code_not_present" } }, { "id": "CVE-2020-15258", "affects": [ { "ref": "pkg:maven/org.apache.activemq/apache-artemis@2.33.0-tuxcare.9" } ], "bom-ref": "urn:uuid:c3754bd9-c0d8-5451-8cfa-cb8ec9457df2", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2020-15258 is a false positive for org.apache.activemq:apache-artemis 2.33.0-tuxcare.9. false_positive \u2014 CVE-2020-15258 is a wrong-project match. The advisory concerns Wire (an Electron-based secure communication application), but the target repository is Apache ActiveMQ Artemis (a Java-based message broker). The vulnerable component (shell.openExternal Electron API) and affected product code are entirely absent from this repository." } }, { "id": "CVE-2020-27853", "affects": [ { "ref": "pkg:maven/org.apache.activemq/apache-artemis@2.33.0-tuxcare.9" } ], "bom-ref": "urn:uuid:82d3bc53-b874-5646-92f7-02b3359f2b85", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2020-27853 is a false positive for org.apache.activemq:apache-artemis 2.33.0-tuxcare.9. false_positive \u2014 CVE-2020-27853 is a wrong-project match. The CVE concerns Wire AVS (Audio, Video, and Signaling), a C-based WebRTC library used in Wire Secure Messenger applications. The target repository is Apache ActiveMQ Artemis, a Java-based enterprise message broker. No Wire AVS code, dependencies, or related components exist in this repository." } }, { "id": "CVE-2021-21301", "affects": [ { "ref": "pkg:maven/org.apache.activemq/apache-artemis@2.33.0-tuxcare.9" } ], "bom-ref": "urn:uuid:2641a089-b501-5a3d-b474-12ce88ba7e86", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2021-21301 is a false positive for org.apache.activemq:apache-artemis 2.33.0-tuxcare.9. false_positive \u2014 CVE-2021-21301 concerns Wire for iOS, a mobile video calling application. The target repository is Apache ActiveMQ Artemis, a Java-based message broker with no video/camera functionality. This is a wrong-project match with no containment relationship." } }, { "id": "CVE-2021-26117", "affects": [ { "ref": "pkg:maven/org.apache.activemq/apache-artemis@2.33.0-tuxcare.9" } ], "bom-ref": "urn:uuid:a50d5f31-3ead-57e8-a159-658321ddab77", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-26117 does not affect version 2.33.0-tuxcare.9 of org.apache.activemq:apache-artemis. Apache ActiveMQ Artemis 2.33.0 is NOT affected by CVE-2021-26117. The vulnerability (LDAP authentication bypass when anonymous access is configured) was fixed in upstream Apache commits that shipped in version 2.33.0, well before TuxCare onboarded this version. Two upstream defenses are present: (1) commit 53f8bc3daf (ARTEMIS-2010, Aug 2018) adds password null/empty validation per RFC 4513, and (2) commit 5db68a451b6 (ARTEMIS-1372, Sep 2017) prevents anonymous LDAP connections by requiring both CONNECTION_USERNAME and CONNECTION_PASSWORD. Both fixes are on the authentication execution path and prevent the attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.16.0), NVD (< 2.16.0), cve.org (< 2.16.0), Snyk (>= 1.2.0, < 2.16.0).", "justification": "code_not_present" } }, { "id": "CVE-2021-32665", "affects": [ { "ref": "pkg:maven/org.apache.activemq/apache-artemis@2.33.0-tuxcare.9" } ], "bom-ref": "urn:uuid:09f96b1f-5b8e-50d9-8f66-0db8d9e8c8ae", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2021-32665 is a false positive for org.apache.activemq:apache-artemis 2.33.0-tuxcare.9. false_positive \u2014 CVE-2021-32665 concerns wire-ios (an iOS messaging app), but the target repository is Apache ActiveMQ Artemis (a Java message broker). This is a wrong-project match with no code relationship between the two products." } }, { "id": "CVE-2021-32666", "affects": [ { "ref": "pkg:maven/org.apache.activemq/apache-artemis@2.33.0-tuxcare.9" } ], "bom-ref": "urn:uuid:b47c38c7-72ce-53b1-a4b7-4a0d5233f459", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2021-32666 is a false positive for org.apache.activemq:apache-artemis 2.33.0-tuxcare.9. false_positive \u2014 CVE-2021-32666 concerns wire-ios (an iOS secure messaging app), but the target repository is Apache ActiveMQ Artemis (a Java message broker). This is a wrong-project match with no code relationship." } }, { "id": "CVE-2021-32755", "affects": [ { "ref": "pkg:maven/org.apache.activemq/apache-artemis@2.33.0-tuxcare.9" } ], "bom-ref": "urn:uuid:83014c61-8168-5522-bb7b-a38c4930aefa", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2021-32755 is a false positive for org.apache.activemq:apache-artemis 2.33.0-tuxcare.9. false_positive \u2014 CVE-2021-32755 concerns Wire iOS Transport (wire-ios-transport), an iOS framework for the Wire collaboration platform. The target repository is Apache ActiveMQ Artemis, a Java message broker. These are completely different products with no dependency or containment relationship. The affected component (iOS websocket implementation with missing certificate pinning) does not exist anywhere in thi..." } }, { "id": "CVE-2021-41093", "affects": [ { "ref": "pkg:maven/org.apache.activemq/apache-artemis@2.33.0-tuxcare.9" } ], "bom-ref": "urn:uuid:b39a0c55-4cf2-5991-b2ed-f0b3c06e2045", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2021-41093 is a false positive for org.apache.activemq:apache-artemis 2.33.0-tuxcare.9. false_positive \u2014 CVE-2021-41093 concerns Wire (an iOS secure messenger application), but the target repository is Apache ActiveMQ Artemis (a Java message broker). These are completely different products with no relationship. The affected component (Wire iOS application code) is entirely absent from this repository." } }, { "id": "CVE-2022-23625", "affects": [ { "ref": "pkg:maven/org.apache.activemq/apache-artemis@2.33.0-tuxcare.9" } ], "bom-ref": "urn:uuid:3fc7246b-a64a-5fb9-9d95-5bd7be4a6352", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-23625 is a false positive for org.apache.activemq:apache-artemis 2.33.0-tuxcare.9. false_positive \u2014 CVE-2022-23625 concerns Wire-ios (wireapp/wire-ios-transport), an iOS messaging application written in Swift/Objective-C. The target repository is Apache ActiveMQ Artemis, a Java-based message broker. These are completely different products with no code relationship." } }, { "id": "CVE-2022-31009", "affects": [ { "ref": "pkg:maven/org.apache.activemq/apache-artemis@2.33.0-tuxcare.9" } ], "bom-ref": "urn:uuid:7d7d6aae-4cae-545c-b4bd-dc82584da187", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-31009 is a false positive for org.apache.activemq:apache-artemis 2.33.0-tuxcare.9. false_positive \u2014 CVE-2022-31009 concerns wire-ios (an iOS Wire client mobile application), not Apache ActiveMQ Artemis (a Java message broker). This is a wrong-project match with no relationship between the advisory's affected product and the target repository." } }, { "id": "CVE-2022-43673", "affects": [ { "ref": "pkg:maven/org.apache.activemq/apache-artemis@2.33.0-tuxcare.9" } ], "bom-ref": "urn:uuid:b4016cd4-4ab1-51da-9a4a-d435a35e2a03", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-43673 is a false positive for org.apache.activemq:apache-artemis 2.33.0-tuxcare.9. false_positive \u2014 CVE-2022-43673 concerns Wire (an Electron-based messaging client application) through version 3.22.3993 on Windows. The target repository is Apache ActiveMQ Artemis 2.33.0-tuxcare.1, a Java-based message broker. These are completely different products with no dependency relationship. The affected component (IndexedDB storage handling in Wire's Windows client) does not exist in this repository." } }, { "id": "CVE-2023-22737", "affects": [ { "ref": "pkg:maven/org.apache.activemq/apache-artemis@2.33.0-tuxcare.9" } ], "bom-ref": "urn:uuid:fc75114e-1cf7-5936-a0bf-dc464c0fcc1f", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2023-22737 is a false positive for org.apache.activemq:apache-artemis 2.33.0-tuxcare.9. false_positive \u2014 CVE-2023-22737 concerns wire-server (a team communication platform), but the target repository is Apache ActiveMQ Artemis (a message broker). This is a wrong-project match with no relationship between the two products." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.activemq/apache-artemis@2.33.0-tuxcare.9" } ] }