{
  "@id": "urn:uuid:6a94bf58-e87e-4ff9-8fd9-de8d7e098be2",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 10,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T04:21:52.088444+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.commons/commons-compress@1.20-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.commons/commons-compress@1.20-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T22:12:57.135800+00:00",
      "status_notes": "Vulnerability CVE-2018-11771 does not affect version 1.20-tuxcare.1 of org.apache.commons:commons-compress. not_affected \u2014 Target version 1.20 is not affected by CVE-2018-11771. The vulnerability (infinite stream due to inconsistent EOF handling in ZipArchiveInputStream.readStored()) was fixed in upstream Apache Commons Compress 1.18 and is present in the target. The fix (throw IOException(\"Truncated ZIP file\") instead of silently returning -1) is at ZipArchiveInputStream.java:555-558 and was authored by upstream A...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11771"
      },
      "impact_statement": "not_affected \u2014 Target version 1.20 is not affected by CVE-2018-11771. The vulnerability (infinite stream due to inconsistent EOF handling in ZipArchiveInputStream.readStored()) was fixed in upstream Apache Commons Compress 1.18 and is present in the target. The fix (throw IOException(\"Truncated ZIP file\") instead of silently returning -1) is at ZipArchiveInputStream.java:555-558 and was authored by upstream A..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.commons/commons-compress@1.20-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.commons/commons-compress@1.20-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T11:29:55.012374+00:00",
      "status_notes": "Vulnerability CVE-2018-1324 does not affect version 1.20-tuxcare.1 of org.apache.commons:commons-compress. not_affected \u2014 Apache Commons Compress version 1.20 is not affected by CVE-2018-1324. The vulnerability affected versions 1.11-1.15 and was fixed in upstream commit 2a2f1dc4 (December 2017) by changing a loop counter from int to long to prevent integer overflow. Version 1.20 was released with this fix already present, so the vulnerable code pattern does not exist in the target.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1324"
      },
      "impact_statement": "not_affected \u2014 Apache Commons Compress version 1.20 is not affected by CVE-2018-1324. The vulnerability affected versions 1.11-1.15 and was fixed in upstream commit 2a2f1dc4 (December 2017) by changing a loop counter from int to long to prevent integer overflow. Version 1.20 was released with this fix already present, so the vulnerable code pattern does not exist in the target."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.commons/commons-compress@1.20-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.commons/commons-compress@1.20-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2019-12402 does not affect version 1.20-tuxcare.1 of org.apache.commons:commons-compress. Target version 1.20-tuxcare.1 is not affected by CVE-2019-12402. The vulnerable infinite loop pattern in NioZipEncoding.encode() was fixed by upstream Apache in version 1.19 (commit 4ad5d80a6). The fix adds a break condition for underflow/error states, preventing the infinite loop. This upstream fix was already present in the Apache Commons Compress 1.20 release that TuxCare onboarded, confirmed by ancestry analysis showing the fix commit predates the first TuxCare commit (615e51fc0 \"setup 1.20\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.15, < 1.19), NVD (>= 1.15, <= 1.18), cve.org (>= 1.15, <= 1.18), Snyk (>= 1.15, < 1.19).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12402"
      },
      "impact_statement": "Target version 1.20-tuxcare.1 is not affected by CVE-2019-12402. The vulnerable infinite loop pattern in NioZipEncoding.encode() was fixed by upstream Apache in version 1.19 (commit 4ad5d80a6). The fix adds a break condition for underflow/error states, preventing the infinite loop. This upstream fix was already present in the Apache Commons Compress 1.20 release that TuxCare onboarded, confirmed by ancestry analysis showing the fix commit predates the first TuxCare commit (615e51fc0 \"setup 1.20\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.15, < 1.19), NVD (>= 1.15, <= 1.18), cve.org (>= 1.15, <= 1.18), Snyk (>= 1.15, < 1.19)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.commons/commons-compress@1.20-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.commons/commons-compress@1.20-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-35515 is fixed in version 1.20-tuxcare.1 of org.apache.commons:commons-compress.",
      "vulnerability": {
        "name": "CVE-2021-35515"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.commons/commons-compress@1.20-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.commons/commons-compress@1.20-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-35516 is fixed in version 1.20-tuxcare.1 of org.apache.commons:commons-compress.",
      "vulnerability": {
        "name": "CVE-2021-35516"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.commons/commons-compress@1.20-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.commons/commons-compress@1.20-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-35517 is fixed in version 1.20-tuxcare.1 of org.apache.commons:commons-compress.",
      "vulnerability": {
        "name": "CVE-2021-35517"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.commons/commons-compress@1.20-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.commons/commons-compress@1.20-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-36090 is fixed in version 1.20-tuxcare.1 of org.apache.commons:commons-compress.",
      "vulnerability": {
        "name": "CVE-2021-36090"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.commons/commons-compress@1.20-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.commons/commons-compress@1.20-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:25:55.953386+00:00",
      "status_notes": "Vulnerability CVE-2023-42503 does not affect version 1.20-tuxcare.1 of org.apache.commons:commons-compress. not_affected \u2014 Version 1.20 is NOT AFFECTED by CVE-2023-42503. The CVE explicitly states the vulnerability was introduced in version 1.22 when BigDecimal parsing was added for high-precision PAX time fields. Version 1.20 uses Double.parseDouble for mtime only and does not process atime, ctime, or LIBARCHIVE.creationtime at all. The vulnerable code pattern (BigDecimal parsing with algorithmic complexity DoS) d...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-42503"
      },
      "impact_statement": "not_affected \u2014 Version 1.20 is NOT AFFECTED by CVE-2023-42503. The CVE explicitly states the vulnerability was introduced in version 1.22 when BigDecimal parsing was added for high-precision PAX time fields. Version 1.20 uses Double.parseDouble for mtime only and does not process atime, ctime, or LIBARCHIVE.creationtime at all. The vulnerable code pattern (BigDecimal parsing with algorithmic complexity DoS) d..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.commons/commons-compress@1.20-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.commons/commons-compress@1.20-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-25710 is fixed in version 1.20-tuxcare.1 of org.apache.commons:commons-compress.",
      "vulnerability": {
        "name": "CVE-2024-25710"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.commons/commons-compress@1.20-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.commons/commons-compress@1.20-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-10T04:21:52.088444+00:00",
      "status_notes": "Vulnerability CVE-2024-26308 does not affect version 1.20-tuxcare.1 of org.apache.commons:commons-compress. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable Harmony Pack200/unpack200 implementation is absent. Pack200 handling delegates to the JDK unpacker, created at src/main/java/org/apache/commons/compress/compressors/pack200/Pack200CompressorInputStream.java:176.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-26308"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable Harmony Pack200/unpack200 implementation is absent. Pack200 handling delegates to the JDK unpacker, created at src/main/java/org/apache/commons/compress/compressors/pack200/Pack200CompressorInputStream.java:176."
    }
  ]
}