{
  "@id": "urn:uuid:f50dfc6c-b0ce-4ae4-bff4-be4787e66c5f",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 8,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T04:21:52.088444+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.commons/commons-compress@1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.commons/commons-compress@1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T22:09:07.966694+00:00",
      "status_notes": "Vulnerability CVE-2018-11771 does not affect version 1.18-tuxcare.2 of org.apache.commons:commons-compress. not_affected \u2014 The target repository (commons-compress version 1.18-tuxcare.3) is NOT AFFECTED by CVE-2018-11771. The vulnerability was fixed in upstream Apache Commons Compress version 1.18 via commit a41ce6892 by Stefan Bodewig on August 9, 2018. When TuxCare onboarded version 1.18 via commit 6487b26a5, the fix was already present in the upstream release. The vulnerable code pattern (silently returning -1 w...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11771"
      },
      "impact_statement": "not_affected \u2014 The target repository (commons-compress version 1.18-tuxcare.3) is NOT AFFECTED by CVE-2018-11771. The vulnerability was fixed in upstream Apache Commons Compress version 1.18 via commit a41ce6892 by Stefan Bodewig on August 9, 2018. When TuxCare onboarded version 1.18 via commit 6487b26a5, the fix was already present in the upstream release. The vulnerable code pattern (silently returning -1 w..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.commons/commons-compress@1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.commons/commons-compress@1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:29:55.012374+00:00",
      "status_notes": "Vulnerability CVE-2018-1324 does not affect version 1.18-tuxcare.2 of org.apache.commons:commons-compress. not_affected \u2014 CVE-2018-1324 affects Apache Commons Compress versions 1.11-1.15. The target version 1.18-tuxcare.3 is not affected because the upstream vendor (Apache) fixed the vulnerability in commit 2a2f1dc48 (Dec 22, 2017) before releasing version 1.18. The fix changed the loop counter from 'int i' to 'long i' in X0017_StrongEncryptionHeader.java line 313, preventing integer overflow that caused infinite ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1324"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1324 affects Apache Commons Compress versions 1.11-1.15. The target version 1.18-tuxcare.3 is not affected because the upstream vendor (Apache) fixed the vulnerability in commit 2a2f1dc48 (Dec 22, 2017) before releasing version 1.18. The fix changed the loop counter from 'int i' to 'long i' in X0017_StrongEncryptionHeader.java line 313, preventing integer overflow that caused infinite ..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.commons/commons-compress@1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.commons/commons-compress@1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2019-12402 is fixed in version 1.18-tuxcare.2 of org.apache.commons:commons-compress.",
      "vulnerability": {
        "name": "CVE-2019-12402"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.commons/commons-compress@1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.commons/commons-compress@1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-35515 is fixed in version 1.18-tuxcare.2 of org.apache.commons:commons-compress.",
      "vulnerability": {
        "name": "CVE-2021-35515"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.commons/commons-compress@1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.commons/commons-compress@1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-35516 affects version 1.18-tuxcare.2 of org.apache.commons:commons-compress.",
      "vulnerability": {
        "name": "CVE-2021-35516"
      },
      "action_statement": "Vulnerability CVE-2021-35516 affects version 1.18-tuxcare.2 of org.apache.commons:commons-compress."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.commons/commons-compress@1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.commons/commons-compress@1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-35517 affects version 1.18-tuxcare.2 of org.apache.commons:commons-compress.",
      "vulnerability": {
        "name": "CVE-2021-35517"
      },
      "action_statement": "Vulnerability CVE-2021-35517 affects version 1.18-tuxcare.2 of org.apache.commons:commons-compress."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.commons/commons-compress@1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.commons/commons-compress@1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-36090 affects version 1.18-tuxcare.2 of org.apache.commons:commons-compress.",
      "vulnerability": {
        "name": "CVE-2021-36090"
      },
      "action_statement": "Vulnerability CVE-2021-36090 affects version 1.18-tuxcare.2 of org.apache.commons:commons-compress."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.commons/commons-compress@1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.commons/commons-compress@1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:23:26.744347+00:00",
      "status_notes": "Vulnerability CVE-2023-42503 does not affect version 1.18-tuxcare.2 of org.apache.commons:commons-compress. not_affected \u2014 Version 1.18-tuxcare.3 is NOT AFFECTED by CVE-2023-42503. The vulnerable code pattern (BigDecimal parsing of PAX extended header time fields without validation) was introduced in version 1.22 through COMPRESS-612. Version 1.18 uses Double.parseDouble() for \"mtime\" parsing only, which is not vulnerable to the BigDecimal algorithmic complexity issue (JDK-6560193). The fields \"atime\", \"ctime\", and...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-42503"
      },
      "impact_statement": "not_affected \u2014 Version 1.18-tuxcare.3 is NOT AFFECTED by CVE-2023-42503. The vulnerable code pattern (BigDecimal parsing of PAX extended header time fields without validation) was introduced in version 1.22 through COMPRESS-612. Version 1.18 uses Double.parseDouble() for \"mtime\" parsing only, which is not vulnerable to the BigDecimal algorithmic complexity issue (JDK-6560193). The fields \"atime\", \"ctime\", and..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.commons/commons-compress@1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.commons/commons-compress@1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-25710 affects version 1.18-tuxcare.2 of org.apache.commons:commons-compress, and is fixed in 1.18-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2024-25710"
      },
      "action_statement": "Vulnerability CVE-2024-25710 affects version 1.18-tuxcare.2 of org.apache.commons:commons-compress, and is fixed in 1.18-tuxcare.3."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.commons/commons-compress@1.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.commons/commons-compress@1.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-10T04:21:52.088444+00:00",
      "status_notes": "Vulnerability CVE-2024-26308 does not affect version 1.18-tuxcare.2 of org.apache.commons:commons-compress. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable in-tree Pack200 parser is absent. The wrapper imports the JDK\u2019s java.util.jar.Pack200 at src/main/java/org/apache/commons/compress/compressors/pack200/Pack200CompressorInputStream.java:28 and delegates stream and file unpacking to that implementation through Pack200.newUnpacker() at src/main/java/org/apache/commons/compress/compressors/pack200/Pack200CompressorInputStream.java:169.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-26308"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable in-tree Pack200 parser is absent. The wrapper imports the JDK\u2019s java.util.jar.Pack200 at src/main/java/org/apache/commons/compress/compressors/pack200/Pack200CompressorInputStream.java:28 and delegates stream and file unpacking to that implementation through Pack200.newUnpacker() at src/main/java/org/apache/commons/compress/compressors/pack200/Pack200CompressorInputStream.java:169."
    }
  ]
}