{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:27e95ae2-3cac-5a24-9d64-5f108cc4dd4f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "commons-configuration2", "purl": "pkg:maven/org.apache.commons/commons-configuration2@2.12.0-tuxcare.2", "type": "library", "group": "org.apache.commons", "bom-ref": "pkg:maven/org.apache.commons/commons-configuration2@2.12.0-tuxcare.2", "version": "2.12.0-tuxcare.2", "pedigree": { "ancestors": [ { "name": "commons-configuration2", "purl": "pkg:maven/org.apache.commons/commons-configuration2@2.12.0", "type": "library", "group": "org.apache.commons", "version": "2.12.0" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2020-1953", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-configuration2@2.12.0-tuxcare.2" } ], "bom-ref": "urn:uuid:5c46fa3c-cc56-56bc-9e51-ee1e4d4f8bbe", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-1953 does not affect version 2.12.0-tuxcare.2 of org.apache.commons:commons-configuration2. CVE-2020-1953 is not present in Apache Commons Configuration 2.12.0. The vulnerability (arbitrary Java object instantiation via YAML type tags like !!java.io.FileOutputStream) was fixed by upstream Apache in March 2020 (commit add7375c). This fix was already included in the upstream 2.12.0 release that TuxCare onboarded. The current code uses SnakeYAML's SafeConstructor which blocks all arbitrary class instantiation, allowing only safe types (String, Integer, Map, List, etc.). Tests verify that malicious YAML with Java type tags is rejected and no objects are created.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.2, < 2.7), NVD (= 2.2; = 2.3; = 2.4; = 2.5; = 2.6), cve.org (= 2.2; = 2.3; = 2.4; = 2.5; = 2.6), Snyk (>= 2.2, < 2.7).", "justification": "code_not_present" } }, { "id": "CVE-2022-33980", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-configuration2@2.12.0-tuxcare.2" } ], "bom-ref": "urn:uuid:ae9b5104-cbbf-5268-b851-b9648b859872", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-33980 does not affect version 2.12.0-tuxcare.2 of org.apache.commons:commons-configuration2. Target version 2.12.0 is not affected by CVE-2022-33980. The vulnerability involved dangerous interpolation lookups (dns, url, script) being enabled by default in versions 2.4-2.7, allowing RCE or remote server contact via untrusted configuration values. The fix removed these lookups from defaults and was released in upstream version 2.8.0. The target already contains this upstream fix from version 2.12.0, where the createDefaultLookups() method explicitly excludes DNS, URL, and SCRIPT lookups while retaining only safe lookups like URL_ENCODER/URL_DECODER (string encoding/decoding utilities, not URL fetchers).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4, < 2.8.0), NVD (>= 2.4, < 2.8), cve.org (< 2.8.0), Snyk (>= 2.4, < 2.8).", "justification": "code_not_present" } }, { "id": "CVE-2024-29131", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-configuration2@2.12.0-tuxcare.2" } ], "bom-ref": "urn:uuid:fd9e939b-cdb0-5dd8-92d2-d8cd319b892e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-29131 does not affect version 2.12.0-tuxcare.2 of org.apache.commons:commons-configuration2. Target version 2.12.0 is NOT affected by CVE-2024-29131. The vulnerability (StackOverflowError due to missing cycle detection in AbstractListDelimiterHandler.flattenIterator()) was fixed in upstream version 2.10.1. The target version 2.12.0 already contains the upstream fix (commits 56b5c4dc and 7d7d399d by Gary Gregory) which adds IdentityHashMap-based cycle detection to prevent infinite recursion when flattening self-referential Iterable objects. The fix was shipped in the upstream release that TuxCare onboarded, not backported by TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0, < 2.10.1), NVD (>= 2.0, < 2.10.1), cve.org (>= 2.0, < 2.10.1; >= 2.0, < 2.10.1), Snyk (>= 2.0.0, < 2.10.1).", "justification": "code_not_present" } }, { "id": "CVE-2024-29133", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-configuration2@2.12.0-tuxcare.2" } ], "bom-ref": "urn:uuid:325ac7a1-fe42-5439-9d53-a13a6a01c75c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-29133 does not affect version 2.12.0-tuxcare.2 of org.apache.commons:commons-configuration2. not_affected \u2014 CVE-2024-29133 is NOT present in the target. The vulnerability involved a StackOverflowError when flattening cyclical object trees due to pre-adding the root value to the cycle-detection set. The fix (commit 43f4dab0) was shipped in upstream Apache Commons Configuration 2.12.0 release, before TuxCare onboarded this version. The target code at ListDelimiterHandler.java:96 shows the fixed pattern...", "justification": "code_not_present" } }, { "id": "CVE-2026-45205", "affects": [ { "ref": "pkg:maven/org.apache.commons/commons-configuration2@2.12.0-tuxcare.2" } ], "bom-ref": "urn:uuid:2d340554-321a-5397-9b2b-87afd2a597d5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-45205 is fixed in version 2.12.0-tuxcare.2 of org.apache.commons:commons-configuration2." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.commons/commons-configuration2@2.12.0-tuxcare.2" } ] }