{
  "@id": "urn:uuid:cf91a9f2-0295-493e-bec9-e2bb784d7f3a",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-07T00:41:35.685763+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/apache-cxf@3.4.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/apache-cxf@3.4.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-07T00:41:35.685763+00:00",
      "status_notes": "Vulnerability CVE-2018-8039 does not affect version 3.4.5-tuxcare.2 of org.apache.cxf:apache-cxf. The target Apache CXF 3.4.5 is NOT AFFECTED by CVE-2018-8039. The vulnerability involved hostname verification being silently bypassed when using the deprecated com.sun.net.ssl stack due to reflection exception handling that returned 'true' (verification passed) instead of 'false' (verification failed). The upstream fix commit fae6fabf9bd7647f5e9cb68897a7d72b545b741b from May 2018 corrected this by changing the exception handler to return 'false', properly rejecting connections when hostname verification fails. This fix was already present in the upstream Apache CXF 3.4.5 release that TuxCare onboarded, as confirmed by git ancestry analysis showing the fix commit predates the first TuxCare commit (b4e3552acd2 \"Onboarding for 3.4.5\"). The fix is verified in the current code at HttpsURLConnectionFactory.java line 193.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.2.0, < 3.2.5; < 3.1.16; >= 3.2.0, < 3.2.5; < 3.1.16), NVD (< 3.1.16; >= 3.2.0, < 3.2.5), cve.org (< 3.1.16; >= 3.2, < 3.2.5), Snyk (< 3.1.16; >= 3.2.0, < 3.2.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-8039"
      },
      "impact_statement": "The target Apache CXF 3.4.5 is NOT AFFECTED by CVE-2018-8039. The vulnerability involved hostname verification being silently bypassed when using the deprecated com.sun.net.ssl stack due to reflection exception handling that returned 'true' (verification passed) instead of 'false' (verification failed). The upstream fix commit fae6fabf9bd7647f5e9cb68897a7d72b545b741b from May 2018 corrected this by changing the exception handler to return 'false', properly rejecting connections when hostname verification fails. This fix was already present in the upstream Apache CXF 3.4.5 release that TuxCare onboarded, as confirmed by git ancestry analysis showing the fix commit predates the first TuxCare commit (b4e3552acd2 \"Onboarding for 3.4.5\"). The fix is verified in the current code at HttpsURLConnectionFactory.java line 193.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.2.0, < 3.2.5; < 3.1.16; >= 3.2.0, < 3.2.5; < 3.1.16), NVD (< 3.1.16; >= 3.2.0, < 3.2.5), cve.org (< 3.1.16; >= 3.2, < 3.2.5), Snyk (< 3.1.16; >= 3.2.0, < 3.2.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/apache-cxf@3.4.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/apache-cxf@3.4.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-07T00:41:35.685763+00:00",
      "status_notes": "Vulnerability CVE-2019-12406 does not affect version 3.4.5-tuxcare.2 of org.apache.cxf:apache-cxf. not_affected \u2014 CVE-2019-12406 is NOT present in Apache CXF 3.4.5-tuxcare.1. The fix for this vulnerability was already included in the upstream Apache CXF 3.4.5 release (committed 2019-09-03 by Apache committer coheigea@apache.org) before TuxCare onboarded the version. The target code contains the complete mitigation: AttachmentDeserializer passes a configurable maxCount (default 50) to LazyAttachmentCollecti...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12406"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-12406 is NOT present in Apache CXF 3.4.5-tuxcare.1. The fix for this vulnerability was already included in the upstream Apache CXF 3.4.5 release (committed 2019-09-03 by Apache committer coheigea@apache.org) before TuxCare onboarded the version. The target code contains the complete mitigation: AttachmentDeserializer passes a configurable maxCount (default 50) to LazyAttachmentCollecti..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/apache-cxf@3.4.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/apache-cxf@3.4.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-07T00:41:35.685763+00:00",
      "status_notes": "Vulnerability CVE-2019-12423 does not affect version 3.4.5-tuxcare.2 of org.apache.cxf:apache-cxf. CVE-2019-12423 affects Apache CXF's OpenId Connect JWK Keys service, which could expose private keys and secret keys when using JWK keystores. The vulnerability was fixed in upstream Apache CXF commit 6852cd5e4927f8e651c0a0589b5ee3f61e753186 (2019-11-14) by Colm O hEigeartaigh. This fix was included in the Apache CXF 3.4.5 upstream release (2021-09-29), which TuxCare onboarded on 2026-04-10. Therefore, the target repository at version 3.4.5 already contains the upstream fix and is not vulnerable. The defense code (stripPrivateParameters method, loadPublicVerificationKeys with stripping enabled by default, and JwksService with stripPrivateParameters=true) is present and active in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.12; >= 3.3.0, < 3.3.5; < 3.2.12; >= 3.3.0, < 3.3.5), NVD (< 3.2.12; >= 3.3.0, < 3.3.5), cve.org (< 3.3.5; < 3.2.12), Snyk (< 3.2.12; >= 3.3.0, < 3.3.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12423"
      },
      "impact_statement": "CVE-2019-12423 affects Apache CXF's OpenId Connect JWK Keys service, which could expose private keys and secret keys when using JWK keystores. The vulnerability was fixed in upstream Apache CXF commit 6852cd5e4927f8e651c0a0589b5ee3f61e753186 (2019-11-14) by Colm O hEigeartaigh. This fix was included in the Apache CXF 3.4.5 upstream release (2021-09-29), which TuxCare onboarded on 2026-04-10. Therefore, the target repository at version 3.4.5 already contains the upstream fix and is not vulnerable. The defense code (stripPrivateParameters method, loadPublicVerificationKeys with stripping enabled by default, and JwksService with stripPrivateParameters=true) is present and active in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.12; >= 3.3.0, < 3.3.5; < 3.2.12; >= 3.3.0, < 3.3.5), NVD (< 3.2.12; >= 3.3.0, < 3.3.5), cve.org (< 3.3.5; < 3.2.12), Snyk (< 3.2.12; >= 3.3.0, < 3.3.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/apache-cxf@3.4.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/apache-cxf@3.4.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-07T00:41:35.685763+00:00",
      "status_notes": "Vulnerability CVE-2019-17573 does not affect version 3.4.5-tuxcare.2 of org.apache.cxf:apache-cxf. not_affected \u2014 CVE-2019-17573 is NOT present in the target. The XSS vulnerability in the service listing page has been fixed by HTML-escaping URLs before output. The fix (commit 4ca5f7b921) was authored by Apache developer Colm O hEigeartaigh on 2019-12-18 and was already included in the upstream Apache CXF 3.4.5 release before TuxCare onboarded it on 2026-04-10. Both FormattedServiceListWriter and Unformatte...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17573"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-17573 is NOT present in the target. The XSS vulnerability in the service listing page has been fixed by HTML-escaping URLs before output. The fix (commit 4ca5f7b921) was authored by Apache developer Colm O hEigeartaigh on 2019-12-18 and was already included in the upstream Apache CXF 3.4.5 release before TuxCare onboarded it on 2026-04-10. Both FormattedServiceListWriter and Unformatte..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/apache-cxf@3.4.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/apache-cxf@3.4.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-07T00:41:35.685763+00:00",
      "status_notes": "Vulnerability CVE-2020-13954 does not affect version 3.4.5-tuxcare.2 of org.apache.cxf:apache-cxf. not_affected \u2014 CVE-2020-13954 affects Apache CXF versions prior to 3.4.1 and 3.3.8. The target is Apache CXF 3.4.5-tuxcare.1, which already contains the upstream fix. The vulnerable code pattern (unescaped styleSheetPath rendering) is not present in this version because HTML escaping was added in the upstream 3.4.5 release before TuxCare onboarding.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-13954"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-13954 affects Apache CXF versions prior to 3.4.1 and 3.3.8. The target is Apache CXF 3.4.5-tuxcare.1, which already contains the upstream fix. The vulnerable code pattern (unescaped styleSheetPath rendering) is not present in this version because HTML escaping was added in the upstream 3.4.5 release before TuxCare onboarding."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/apache-cxf@3.4.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/apache-cxf@3.4.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-07T00:41:35.685763+00:00",
      "status_notes": "Vulnerability CVE-2021-22696 does not affect version 3.4.5-tuxcare.2 of org.apache.cxf:apache-cxf. CVE-2021-22696 is NOT present in Apache CXF 3.4.5. The vulnerability affected versions prior to 3.4.3, and version 3.4.5 includes the upstream fix that disables request_uri support by default. The fix commits (7d5d2c7a and aee3bf291a) authored by the upstream Apache maintainer are present in HEAD and were shipped as part of the upstream 3.4.5 release, prior to TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.4.0, < 3.4.3; < 3.3.10; >= 3.4.0, < 3.4.3; < 3.3.10), NVD (< 3.3.10; >= 3.4.0, < 3.4.3), cve.org (< 3.4.3; < 3.3.10), Snyk (< 3.3.10; >= 3.4.0, < 3.4.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22696"
      },
      "impact_statement": "CVE-2021-22696 is NOT present in Apache CXF 3.4.5. The vulnerability affected versions prior to 3.4.3, and version 3.4.5 includes the upstream fix that disables request_uri support by default. The fix commits (7d5d2c7a and aee3bf291a) authored by the upstream Apache maintainer are present in HEAD and were shipped as part of the upstream 3.4.5 release, prior to TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.4.0, < 3.4.3; < 3.3.10; >= 3.4.0, < 3.4.3; < 3.3.10), NVD (< 3.3.10; >= 3.4.0, < 3.4.3), cve.org (< 3.4.3; < 3.3.10), Snyk (< 3.3.10; >= 3.4.0, < 3.4.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.cxf/apache-cxf@3.4.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.cxf/apache-cxf@3.4.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-07T00:41:35.685763+00:00",
      "status_notes": "Vulnerability CVE-2021-30468 does not affect version 3.4.5-tuxcare.2 of org.apache.cxf:apache-cxf. The target Apache CXF 3.4.5 repository is not affected by CVE-2021-30468. The vulnerability (unescaped double quotes in JSON strings causing malformed JSON that triggers infinite parsing loops and CPU exhaustion) was fixed in upstream commit 9d423d4ceb by Apache developer Colm O hEigeartaigh. This fix was already present in the Apache CXF 3.4.5 release that TuxCare onboarded. The target code contains the escapeJson() method and properly escapes both map keys and string values before JSON serialization, preventing the vulnerable pattern from manifesting.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.4.0, < 3.4.4; < 3.3.11; >= 3.4.0, < 3.4.4; < 3.3.11), NVD (< 3.3.11; >= 3.4.0, < 3.4.4), cve.org (< 3.3.11), Snyk (>= 3.4.0, < 3.4.4; < 3.3.11).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-30468"
      },
      "impact_statement": "The target Apache CXF 3.4.5 repository is not affected by CVE-2021-30468. The vulnerability (unescaped double quotes in JSON strings causing malformed JSON that triggers infinite parsing loops and CPU exhaustion) was fixed in upstream commit 9d423d4ceb by Apache developer Colm O hEigeartaigh. This fix was already present in the Apache CXF 3.4.5 release that TuxCare onboarded. The target code contains the escapeJson() method and properly escapes both map keys and string values before JSON serialization, preventing the vulnerable pattern from manifesting.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.4.0, < 3.4.4; < 3.3.11; >= 3.4.0, < 3.4.4; < 3.3.11), NVD (< 3.3.11; >= 3.4.0, < 3.4.4), cve.org (< 3.3.11), Snyk (>= 3.4.0, < 3.4.4; < 3.3.11)."
    }
  ]
}