{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2862cb93-1d3f-5671-a285-7600c004c335", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "netty", "purl": "pkg:maven/org.jboss.netty/netty@3.2.4.Final-tuxcare.2", "type": "library", "group": "org.jboss.netty", "bom-ref": "pkg:maven/org.jboss.netty/netty@3.2.4.Final-tuxcare.2", "version": "3.2.4.Final-tuxcare.2", "pedigree": { "ancestors": [ { "name": "netty", "purl": "pkg:maven/org.jboss.netty/netty@3.2.4.Final", "type": "library", "group": "org.jboss.netty", "version": "3.2.4.Final" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2015-2156", "affects": [ { "ref": "pkg:maven/org.jboss.netty/netty@3.2.4.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:cf4c3b3a-6bfd-5f7e-8a28-27b9615e585e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-2156 affects version 3.2.4.Final-tuxcare.2 of org.jboss.netty:netty." } }, { "id": "CVE-2019-16869", "affects": [ { "ref": "pkg:maven/org.jboss.netty/netty@3.2.4.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:023e140d-be19-5ebf-a25f-63f446461196", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-16869 affects version 3.2.4.Final-tuxcare.2 of org.jboss.netty:netty, and is fixed in 3.2.4.Final-tuxcare.4." } }, { "id": "CVE-2019-20444", "affects": [ { "ref": "pkg:maven/org.jboss.netty/netty@3.2.4.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:452b15e1-18ca-564f-80a3-62101ec05037", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-20444 affects version 3.2.4.Final-tuxcare.2 of org.jboss.netty:netty, and is fixed in 3.2.4.Final-tuxcare.3." } }, { "id": "CVE-2019-20445", "affects": [ { "ref": "pkg:maven/org.jboss.netty/netty@3.2.4.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:648f378b-3e7e-5177-9669-5754625d4e41", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-20445 affects version 3.2.4.Final-tuxcare.2 of org.jboss.netty:netty." } }, { "id": "CVE-2021-21290", "affects": [ { "ref": "pkg:maven/org.jboss.netty/netty@3.2.4.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:d37eca94-9181-5c45-9197-2931bedc9771", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-21290 does not affect version 3.2.4.Final-tuxcare.2 of org.jboss.netty:netty. not_affected \u2014 Netty 3.2.4.Final is not affected by CVE-2021-21290. The vulnerable multipart upload handling code (AbstractDiskHttpData, HttpPostRequestDecoder, HttpPostMultiPartRequestDecoder) does not exist in this version. The multipart decoder functionality that creates temporary files with insecure permissions was introduced in later versions (3.7.0+, 4.1.x). This version predates the vulnerable feature ...", "justification": "code_not_present" } }, { "id": "CVE-2021-21295", "affects": [ { "ref": "pkg:maven/org.jboss.netty/netty@3.2.4.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:e64b0873-db3e-5721-89d2-7438b5d486d9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-21295 does not affect version 3.2.4.Final-tuxcare.2 of org.jboss.netty:netty. not_affected \u2014 Netty 3.2.4.Final is not affected by CVE-2021-21295. This vulnerability requires HTTP/2 protocol support for HTTP/2-to-HTTP/1.1 request smuggling via malicious Content-Length headers. Netty 3.x (org.jboss.netty) does not have HTTP/2 support - HTTP/2 was added in Netty 4.x (io.netty) and standardized in RFC 7540 (2015), years after Netty 3.2.4 (2010). The target cannot receive HTTP/2 requests, s...", "justification": "code_not_present" } }, { "id": "CVE-2021-21409", "affects": [ { "ref": "pkg:maven/org.jboss.netty/netty@3.2.4.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:45d49667-5c6f-5159-a091-83cd7ac480e8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-21409 does not affect version 3.2.4.Final-tuxcare.2 of org.jboss.netty:netty. not_affected \u2014 CVE-2021-21409 does NOT affect Netty 3.2.4.Final. The vulnerability concerns HTTP/2 HEADERS frame validation in the codec-http2 module (io.netty.handler.codec.http2.DefaultHttp2ConnectionDecoder), which does not exist in Netty 3.x. Netty 3.2.4.Final was released circa 2010 and only supports HTTP/1.x. HTTP/2 support was introduced in Netty 4.x series after HTTP/2 was standardized (RFC 7540, 2015...", "justification": "code_not_present" } }, { "id": "CVE-2021-37136", "affects": [ { "ref": "pkg:maven/org.jboss.netty/netty@3.2.4.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:212cd4a8-8316-5438-9e2e-e062977a3e02", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-37136 does not affect version 3.2.4.Final-tuxcare.2 of org.jboss.netty:netty. Netty version 3.2.4.Final does not contain Bzip2 decompression functionality. The Bzip2Decoder class and all related decompression code identified in CVE-2021-37136 do not exist in this version. The compression package only supports Zlib/gzip/deflate, with a TODO comment explicitly noting \"// TODO Implement bzip2 and lzma handlers\". Git history confirms Bzip2Decoder was first implemented on 2014-06-17, more than 3 years after version 3.2.4.Final was released on 2011-02-07. Since the target cannot receive or process bzip2 compressed data, the vulnerability is not applicable.", "justification": "code_not_present" } }, { "id": "CVE-2021-37137", "affects": [ { "ref": "pkg:maven/org.jboss.netty/netty@3.2.4.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:e5e0c883-fb4b-5285-b780-1cb1f339f09c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-37137 does not affect version 3.2.4.Final-tuxcare.2 of org.jboss.netty:netty. CVE-2021-37137 affects SnappyFrameDecoder in Netty 4.x series (io.netty package). The target is Netty 3.2.4.Final from 2010 (org.jboss.netty package), which predates Snappy support. SnappyFrameDecoder and all Snappy-related code are absent from this version. The compression package contains only Zlib codecs (ZlibDecoder, ZlibEncoder). Exhaustive searches confirm zero Snappy references in source code, dependencies, or configuration. Rule 5 Type A1 satisfied: the INPUT (Snappy-framed compressed data chunks) cannot be received anywhere in the target codebase because the code to process it does not exist.", "justification": "code_not_present" } }, { "id": "CVE-2021-43797", "affects": [ { "ref": "pkg:maven/org.jboss.netty/netty@3.2.4.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:86806670-97c8-5421-9fd6-bad98efeae46", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-43797 affects version 3.2.4.Final-tuxcare.2 of org.jboss.netty:netty, and is fixed in 3.2.4.Final-tuxcare.4." } } ], "dependencies": [ { "ref": "pkg:maven/org.jboss.netty/netty@3.2.4.Final-tuxcare.2" } ] }