{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d1d29013-2b70-51a7-838f-3f8b2131a8f8", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "commons-compress", "purl": "pkg:maven/org.apache.commons/commons-compress@1.22-tuxcare.1", "type": "library", "group": "org.apache.commons", "bom-ref": "pkg:maven/org.apache.commons/commons-compress@1.22-tuxcare.1", "version": "1.22-tuxcare.1", "pedigree": { "ancestors": [ { "name": "commons-compress", "purl": "pkg:maven/org.apache.commons/commons-compress@1.22", "type": "library", "group": "org.apache.commons", "version": "1.22" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2018-11771", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.22-tuxcare.1" } ], "bom-ref": "urn:uuid:745cee7e-b54a-5688-8f99-286ba31a6b32", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-11771 does not affect version 1.22-tuxcare.1 of org.apache.commons:commons-compress. not_affected \u2014 Target version 1.22 is not affected by CVE-2018-11771. The vulnerability was fixed in upstream Apache Commons Compress version 1.18 (commit a41ce6892cb), and version 1.22 (released November 2022) includes this fix from the upstream release. The CVE explicitly lists affected versions as 1.7-1.17, and 1.22 is outside this range. The fix code is present in ZipArchiveInputStream.java:596-599, where...", "justification": "code_not_present" } }, { "id": "CVE-2018-1324", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.22-tuxcare.1" } ], "bom-ref": "urn:uuid:9a1a27b1-737b-5639-b066-8aeff0a58bbd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1324 does not affect version 1.22-tuxcare.1 of org.apache.commons:commons-compress. not_affected \u2014 CVE-2018-1324 is not present in commons-compress 1.22-tuxcare.1. The vulnerable infinite loop pattern was fixed by upstream Apache in December 2017 (commit 2a2f1dc48, changed int to long) and completely removed in February 2021 (commit fda4e34ff). Both fixes were already present in Apache Commons Compress 1.22 released in October 2022, which TuxCare subsequently onboarded. The vulnerable nested...", "justification": "code_not_present" } }, { "id": "CVE-2019-12402", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.22-tuxcare.1" } ], "bom-ref": "urn:uuid:6320138e-8190-5566-aa18-ae29f51ad4ed", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-12402 does not affect version 1.22-tuxcare.1 of org.apache.commons:commons-compress. CVE-2019-12402 affects Apache Commons Compress versions 1.15-1.18. The vulnerability involves an infinite loop in the file name encoding algorithm (NioZipEncoding.encode method) when processing specially crafted character sequences. The target is version 1.22-tuxcare.1, which includes the upstream fix that was shipped in Apache Commons Compress 1.19. The fix (commit 4ad5d80a6) adds a break condition to exit the encoding loop when the CharsetEncoder returns underflow or error states, preventing the infinite loop. This fix was authored by Apache upstream (bodewig@apache.org) and was already present in the 1.22 release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.15, < 1.19), NVD (>= 1.15, <= 1.18), cve.org (>= 1.15, <= 1.18), Snyk (>= 1.15, < 1.19).", "justification": "code_not_present" } }, { "id": "CVE-2021-35515", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.22-tuxcare.1" } ], "bom-ref": "urn:uuid:69c56b04-4c5c-5899-8581-1ac86e2c285a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-35515 affects version 1.22-tuxcare.1 of org.apache.commons:commons-compress." } }, { "id": "CVE-2021-35516", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.22-tuxcare.1" } ], "bom-ref": "urn:uuid:9511d55c-e41c-52fe-b2f0-c9ce0d0d086f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-35516 affects version 1.22-tuxcare.1 of org.apache.commons:commons-compress." } }, { "id": "CVE-2021-35517", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.22-tuxcare.1" } ], "bom-ref": "urn:uuid:ebf06315-a57f-55de-b446-c729cb20bf6e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-35517 affects version 1.22-tuxcare.1 of org.apache.commons:commons-compress." } }, { "id": "CVE-2021-36090", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.22-tuxcare.1" } ], "bom-ref": "urn:uuid:0c39aa9a-b57a-5c58-b00b-688506332f58", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-36090 does not affect version 1.22-tuxcare.1 of org.apache.commons:commons-compress. Target version 1.22 is not affected by CVE-2021-36090. All three upstream patches that fix this vulnerability (AsiExtraField validation, IOUtils.readRange() introduction, and readRange() channel fix) were applied by Apache Commons Compress in June-August 2021. Version 1.22 was released in October 2022 with these fixes already included in the upstream release. The vulnerable pattern (allocate array based on attacker-controlled length, then read into it) has been replaced with a safer pattern (validate length before allocation, and only allocate what is actually read using IOUtils.readRange()).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.21), NVD (>= 1.0, < 1.21), cve.org (<= 1.20), Snyk (>= 1.0, < 1.21).", "justification": "code_not_present" } }, { "id": "CVE-2023-42503", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.22-tuxcare.1" } ], "bom-ref": "urn:uuid:266952e7-47e5-5f3b-8b42-06d9e49bfc8f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-42503 affects version 1.22-tuxcare.1 of org.apache.commons:commons-compress." } }, { "id": "CVE-2024-25710", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.22-tuxcare.1" } ], "bom-ref": "urn:uuid:69ecb9be-5e82-5175-a593-3cdf721e3159", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-25710 is fixed in version 1.22-tuxcare.1 of org.apache.commons:commons-compress." } }, { "id": "CVE-2024-26308", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.22-tuxcare.1" } ], "bom-ref": "urn:uuid:207a3f5c-79e5-5e72-8c29-11198421b067", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-26308 affects version 1.22-tuxcare.1 of org.apache.commons:commons-compress." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.22-tuxcare.1" } ] }