{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:89df5a78-fd1d-5d98-9048-a568ea82856f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "commons-compress", "purl": "pkg:maven/org.apache.commons/commons-compress@1.12-tuxcare.2", "type": "library", "group": "org.apache.commons", "bom-ref": "pkg:maven/org.apache.commons/commons-compress@1.12-tuxcare.2", "version": "1.12-tuxcare.2", "pedigree": { "ancestors": [ { "name": "commons-compress", "purl": "pkg:maven/org.apache.commons/commons-compress@1.12", "type": "library", "group": "org.apache.commons", "version": "1.12" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2018-11771", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.12-tuxcare.2" } ], "bom-ref": "urn:uuid:2bf533f8-1090-547d-88c9-1f3021b1d2cc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11771 affects version 1.12-tuxcare.2 of org.apache.commons:commons-compress." } }, { "id": "CVE-2018-1324", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.12-tuxcare.2" } ], "bom-ref": "urn:uuid:81b6d608-bb45-5812-8a83-fc22283172b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1324 is fixed in version 1.12-tuxcare.2 of org.apache.commons:commons-compress." } }, { "id": "CVE-2019-12402", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.12-tuxcare.2" } ], "bom-ref": "urn:uuid:3002896d-d2b1-5e5a-b854-d8f74e4eb28d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-12402 does not affect version 1.12-tuxcare.2 of org.apache.commons:commons-compress. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because filename encoding already makes progress or exits, preventing the infinite loop. The error-handling branch consumes erroneous characters at src/main/java/org/apache/commons/compress/archivers/zip/NioZipEncoding.java:94, and the underflow branch explicitly exits at src/main/java/org/apache/commons/compress/archivers/zip/NioZipEncoding.java:102. On overflow, the buffer grows by doubling its capacity at src/main/java/org/apache/commons/compress/archivers/zip/ZipEncodingHelper.java:156.", "justification": "code_not_reachable" } }, { "id": "CVE-2021-35515", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.12-tuxcare.2" } ], "bom-ref": "urn:uuid:bbd39a27-1bf1-503b-b48f-b003790cc1c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-35515 is fixed in version 1.12-tuxcare.2 of org.apache.commons:commons-compress." } }, { "id": "CVE-2021-35516", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.12-tuxcare.2" } ], "bom-ref": "urn:uuid:f192ef77-b328-5dd6-847b-f9a1473e19a4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-35516 affects version 1.12-tuxcare.2 of org.apache.commons:commons-compress." } }, { "id": "CVE-2021-35517", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.12-tuxcare.2" } ], "bom-ref": "urn:uuid:674fe370-7174-551e-859c-011bdcad280c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-35517 affects version 1.12-tuxcare.2 of org.apache.commons:commons-compress." } }, { "id": "CVE-2021-36090", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.12-tuxcare.2" } ], "bom-ref": "urn:uuid:b13c9962-bfb2-51f6-8737-3786304fd49d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-36090 affects version 1.12-tuxcare.2 of org.apache.commons:commons-compress." } }, { "id": "CVE-2023-42503", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.12-tuxcare.2" } ], "bom-ref": "urn:uuid:a3c1ae44-4b06-5e72-9df0-f849123f9ab8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-42503 does not affect version 1.12-tuxcare.2 of org.apache.commons:commons-compress. not_affected \u2014 Version 1.12 is NOT affected by CVE-2023-42503. The vulnerable code (parseInstantFromDecimalSeconds using BigDecimal) does not exist in this version. Version 1.12 uses Double.parseDouble() for PAX mtime parsing, which lacks BigDecimal's algorithmic complexity issue (JDK-6560193). The vulnerable code was introduced in version 1.22 per COMPRESS-612. Additionally, three of the four affected time f...", "justification": "code_not_present" } }, { "id": "CVE-2024-25710", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.12-tuxcare.2" } ], "bom-ref": "urn:uuid:ee0540f6-36ab-55fd-b71c-fc69760c4108", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-25710 is fixed in version 1.12-tuxcare.2 of org.apache.commons:commons-compress." } }, { "id": "CVE-2024-26308", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.12-tuxcare.2" } ], "bom-ref": "urn:uuid:4036a2d0-e956-560a-b807-0fc3bc791f5e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-26308 does not affect version 1.12-tuxcare.2 of org.apache.commons:commons-compress. Prechecker: No vulnerable code from the fix was found, and none of the calls on the lines the fix removes appear in this version. Version 1.12 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-4265-ccf5-phj5 (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only).", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.12-tuxcare.2" } ] }