{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:767b03e3-a58e-57df-b924-be7de9d4c6d5", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "commons-compress", "purl": "pkg:maven/org.apache.commons/commons-compress@1.23.0-tuxcare.1", "type": "library", "group": "org.apache.commons", "bom-ref": "pkg:maven/org.apache.commons/commons-compress@1.23.0-tuxcare.1", "version": "1.23.0-tuxcare.1", "pedigree": { "ancestors": [ { "name": "commons-compress", "purl": "pkg:maven/org.apache.commons/commons-compress@1.23.0", "type": "library", "group": "org.apache.commons", "version": "1.23.0" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2018-11771", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.23.0-tuxcare.1" } ], "bom-ref": "urn:uuid:13123440-bfd6-52f3-9ff2-26f4e03c80aa", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-11771 does not affect version 1.23.0-tuxcare.1 of org.apache.commons:commons-compress. not_affected \u2014 CVE-2018-11771 affects Apache Commons Compress 1.7-1.17 where ZipArchiveInputStream.read() could fail to return correct EOF on truncated stored entries, leading to infinite streams and DoS. The target version 1.23.0-tuxcare.1 is NOT affected because the upstream vendor fix (commit a41ce6892 by bodewig@apache.org) was already present in Apache Commons Compress 1.18 (released Aug 2018). Version 1...", "justification": "code_not_present" } }, { "id": "CVE-2018-1324", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.23.0-tuxcare.1" } ], "bom-ref": "urn:uuid:64feb295-cd81-5deb-992c-4602243dd65d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1324 does not affect version 1.23.0-tuxcare.1 of org.apache.commons:commons-compress. not_affected \u2014 CVE-2018-1324 describes an infinite loop vulnerability in Apache Commons Compress versions 1.11-1.15 caused by malicious ZIP extra field data with large rcount and hashSize values. The target version 1.23.0-tuxcare.1 is NOT affected because the vulnerable code pattern (nested loops iterating rcount * hashSize times) has been completely removed by upstream Apache fixes that shipped in the upstre...", "justification": "code_not_present" } }, { "id": "CVE-2019-12402", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.23.0-tuxcare.1" } ], "bom-ref": "urn:uuid:2e223360-b1d3-5cb9-ad88-edf538d00ef4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-12402 does not affect version 1.23.0-tuxcare.1 of org.apache.commons:commons-compress. CVE-2019-12402: The target version 1.23.0 is not affected. The vulnerability (infinite loop in NioZipEncoding.encode() when processing specially crafted file names) was fixed in upstream version 1.19 by commit 4ad5d80a6. The fix adds a break condition for CharsetEncoder underflow/error states. Target version 1.23.0 already contains this upstream fix, which was shipped in the release before TuxCare onboarding. The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.15, < 1.19), NVD (>= 1.15, <= 1.18), cve.org (>= 1.15, <= 1.18), Snyk (>= 1.15, < 1.19).", "justification": "code_not_present" } }, { "id": "CVE-2021-35515", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.23.0-tuxcare.1" } ], "bom-ref": "urn:uuid:8aaad374-aa1f-552e-a5da-42f0a9c4d8d2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-35515 affects version 1.23.0-tuxcare.1 of org.apache.commons:commons-compress." } }, { "id": "CVE-2021-35516", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.23.0-tuxcare.1" } ], "bom-ref": "urn:uuid:1b61421f-71d9-55fd-bdd0-a45ccc75b61d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-35516 affects version 1.23.0-tuxcare.1 of org.apache.commons:commons-compress." } }, { "id": "CVE-2021-35517", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.23.0-tuxcare.1" } ], "bom-ref": "urn:uuid:e3b1dcb9-7602-57fc-aaf8-d3bdb3556df6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-35517 affects version 1.23.0-tuxcare.1 of org.apache.commons:commons-compress." } }, { "id": "CVE-2021-36090", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.23.0-tuxcare.1" } ], "bom-ref": "urn:uuid:8f754338-2b65-5680-94c6-dc6d49d43b2b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-36090 does not affect version 1.23.0-tuxcare.1 of org.apache.commons:commons-compress. CVE-2021-36090 is NOT present in commons-compress 1.23.0. All three upstream patches fixing this vulnerability were included in the Apache Commons Compress 1.23.0 release before TuxCare onboarded it. The fixes include: (1) AsiExtraField validation to check length before allocation, (2) comprehensive refactoring to replace allocate-then-fill pattern with safe IOUtils.readRange() methods, and (3) IOUtils.readRange() fix to prevent over-reading. The vulnerable code pattern (pre-allocating arrays based on untrusted size values from ZIP metadata without validation) has been replaced throughout the codebase with incremental allocation that prevents memory exhaustion attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.21), NVD (>= 1.0, < 1.21), cve.org (<= 1.20), Snyk (>= 1.0, < 1.21).", "justification": "code_not_present" } }, { "id": "CVE-2023-42503", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.23.0-tuxcare.1" } ], "bom-ref": "urn:uuid:f304d110-eea4-50f2-8131-e7c3afb6ca9d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-42503 affects version 1.23.0-tuxcare.1 of org.apache.commons:commons-compress." } }, { "id": "CVE-2024-25710", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.23.0-tuxcare.1" } ], "bom-ref": "urn:uuid:3ad9327c-691d-57eb-8942-7d023a9b6a08", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-25710 is fixed in version 1.23.0-tuxcare.1 of org.apache.commons:commons-compress." } }, { "id": "CVE-2024-26308", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.23.0-tuxcare.1" } ], "bom-ref": "urn:uuid:7c5f19d3-1f12-57b7-9840-b4b0f0d202ae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-26308 affects version 1.23.0-tuxcare.1 of org.apache.commons:commons-compress." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.commons/commons-compress@1.23.0-tuxcare.1" } ] }