{ "@id": "urn:uuid:ffa7afd1-11c7-4368-9f75-8acef083b73d", "role": "Document Creator", "author": "https://tuxcare.com", "version": 34, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-12T05:32:00.110255+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/apache-cxf@3.5.9-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.apache.cxf/apache-cxf@3.5.9-tuxcare.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2005-4838 does not affect version 3.5.9-tuxcare.4 of org.apache.cxf:apache-cxf. Patches already applied: f3932a9ab64689e354e9c36da95f001049fde13d (already in target via 6a984d1184f 'Adding a test for the service listing + private endpoints'); 576b9b55ff80b118bc16c33df755ae518ba5f13e (already in target via 1cf50e500c9 'Fixing issue with multiple forward slashes in services listing stylesheetPath')", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2005-4838" }, "impact_statement": "Patches already applied: f3932a9ab64689e354e9c36da95f001049fde13d (already in target via 6a984d1184f 'Adding a test for the service listing + private endpoints'); 576b9b55ff80b118bc16c33df755ae518ba5f13e (already in target via 1cf50e500c9 'Fixing issue with multiple forward slashes in services listing stylesheetPath')" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/apache-cxf@3.5.9-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.apache.cxf/apache-cxf@3.5.9-tuxcare.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2007-1358 does not affect version 3.5.9-tuxcare.4 of org.apache.cxf:apache-cxf. All 1 patch commits already exist in target branch", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2007-1358" }, "impact_statement": "All 1 patch commits already exist in target branch" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/apache-cxf@3.5.9-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.apache.cxf/apache-cxf@3.5.9-tuxcare.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2008-0128 is a false positive for org.apache.cxf:apache-cxf 3.5.9-tuxcare.4. false_positive \u2014 CVE-2008-0128 concerns Apache Tomcat's SingleSignOn valve (org.apache.catalina.authenticator.SingleSignOn) failing to set the secure flag on JSESSIONIDSSO cookies. This repository is Apache CXF 3.5.9-tuxcare.6, a web services framework that does not contain, vendor, or bundle any Tomcat code in its production distribution. Tomcat appears only as a test-scoped dependency for integration testing....", "vulnerability": { "name": "CVE-2008-0128" }, "impact_statement": "false_positive \u2014 CVE-2008-0128 concerns Apache Tomcat's SingleSignOn valve (org.apache.catalina.authenticator.SingleSignOn) failing to set the secure flag on JSESSIONIDSSO cookies. This repository is Apache CXF 3.5.9-tuxcare.6, a web services framework that does not contain, vendor, or bundle any Tomcat code in its production distribution. Tomcat appears only as a test-scoped dependency for integration testing...." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/apache-cxf@3.5.9-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.apache.cxf/apache-cxf@3.5.9-tuxcare.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2009-2696 does not affect version 3.5.9-tuxcare.4 of org.apache.cxf:apache-cxf. Version 3.5.9 is not affected by CVE-2009-2696: the security fix is already present in the target branch. Momus prerequisite check: \"Patches already applied: f3932a9ab64689e354e9c36da95f001049fde13d, 576\". No backport needed.", "vulnerability": { "name": "CVE-2009-2696" }, "impact_statement": "Version 3.5.9 is not affected by CVE-2009-2696: the security fix is already present in the target branch. Momus prerequisite check: \"Patches already applied: f3932a9ab64689e354e9c36da95f001049fde13d, 576\". No backport needed." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/apache-cxf@3.5.9-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.apache.cxf/apache-cxf@3.5.9-tuxcare.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2010-1151 is a false positive for org.apache.cxf:apache-cxf 3.5.9-tuxcare.4. false_positive \u2014 CVE-2010-1151 concerns mod_auth_shadow module for Apache HTTP Server, but this repository is Apache CXF (a Java web services framework). This is a wrong-project match - the affected component is completely absent from this repository.", "vulnerability": { "name": "CVE-2010-1151" }, "impact_statement": "false_positive \u2014 CVE-2010-1151 concerns mod_auth_shadow module for Apache HTTP Server, but this repository is Apache CXF (a Java web services framework). This is a wrong-project match - the affected component is completely absent from this repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/apache-cxf@3.5.9-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.apache.cxf/apache-cxf@3.5.9-tuxcare.4" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2013-4444 is a false positive for org.apache.cxf:apache-cxf 3.5.9-tuxcare.4. direct vulnerability is in Apache Tomcat project", "vulnerability": { "name": "CVE-2013-4444" }, "impact_statement": "direct vulnerability is in Apache Tomcat project" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/apache-cxf@3.5.9-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.apache.cxf/apache-cxf@3.5.9-tuxcare.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2013-6357 is a false positive for org.apache.cxf:apache-cxf 3.5.9-tuxcare.4. false_positive \u2014 CVE-2013-6357 is a wrong-project match. This repository is Apache CXF, a web services framework. The CVE concerns the Manager application in Apache Tomcat 5.5.25 and earlier, which is a completely different Apache project. The Tomcat Manager application and its vulnerable endpoints are not present in this repository.", "vulnerability": { "name": "CVE-2013-6357" }, "impact_statement": "false_positive \u2014 CVE-2013-6357 is a wrong-project match. This repository is Apache CXF, a web services framework. The CVE concerns the Manager application in Apache Tomcat 5.5.25 and earlier, which is a completely different Apache project. The Tomcat Manager application and its vulnerable endpoints are not present in this repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/apache-cxf@3.5.9-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.apache.cxf/apache-cxf@3.5.9-tuxcare.4" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2014-0119 is a false positive for org.apache.cxf:apache-cxf 3.5.9-tuxcare.4. direct vulnerability is in Apache Tomcat project", "vulnerability": { "name": "CVE-2014-0119" }, "impact_statement": "direct vulnerability is in Apache Tomcat project" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/apache-cxf@3.5.9-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.apache.cxf/apache-cxf@3.5.9-tuxcare.4" } } ], "timestamp": "2026-11-03T12:04:03.421384+00:00", "status_notes": "Vulnerability CVE-2018-8039 does not affect version 3.5.9-tuxcare.4 of org.apache.cxf:apache-cxf. CVE-2018-8039 is not present in Apache CXF 3.5.9. The upstream fix commit fae6fabf9bd7647f5e9cb68897a7d72b545b741b (authored by coheigea@apache.org on 2018-05-23) is present in HEAD and predates TuxCare's first commit. The critical security fix changes HttpsURLConnectionFactory.java:193 from `return true` to `return false` in the exception handler, ensuring that when using the deprecated com.sun.net.ssl stack, hostname verification failures result in rejected connections rather than silently passing. This prevents MITM attacks. The vulnerable pattern (returning true on exception) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.2.0, < 3.2.5; < 3.1.16; >= 3.2.0, < 3.2.5; < 3.1.16), NVD (< 3.1.16; >= 3.2.0, < 3.2.5), cve.org (< 3.1.16; >= 3.2, < 3.2.5), Snyk (< 3.1.16; >= 3.2.0, < 3.2.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-8039" }, "impact_statement": "CVE-2018-8039 is not present in Apache CXF 3.5.9. The upstream fix commit fae6fabf9bd7647f5e9cb68897a7d72b545b741b (authored by coheigea@apache.org on 2018-05-23) is present in HEAD and predates TuxCare's first commit. The critical security fix changes HttpsURLConnectionFactory.java:193 from `return true` to `return false` in the exception handler, ensuring that when using the deprecated com.sun.net.ssl stack, hostname verification failures result in rejected connections rather than silently passing. This prevents MITM attacks. The vulnerable pattern (returning true on exception) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.2.0, < 3.2.5; < 3.1.16; >= 3.2.0, < 3.2.5; < 3.1.16), NVD (< 3.1.16; >= 3.2.0, < 3.2.5), cve.org (< 3.1.16; >= 3.2, < 3.2.5), Snyk (< 3.1.16; >= 3.2.0, < 3.2.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/apache-cxf@3.5.9-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.apache.cxf/apache-cxf@3.5.9-tuxcare.4" } } ], "timestamp": "2026-11-02T17:34:00.131982+00:00", "status_notes": "Vulnerability CVE-2019-12406 does not affect version 3.5.9-tuxcare.4 of org.apache.cxf:apache-cxf. not_affected \u2014 CVE-2019-12406 affects Apache CXF versions before 3.3.4 and 3.2.11 that lack attachment count limits, allowing DoS via messages with excessive attachments. The target version 3.5.9 already contains the upstream fix (commit 6c3990144b) that enforces a default limit of 50 attachments (configurable via ATTACHMENT_MAX_COUNT). This fix was authored by Apache CXF maintainer Colm O hEigeartaigh and sh...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12406" }, "impact_statement": "not_affected \u2014 CVE-2019-12406 affects Apache CXF versions before 3.3.4 and 3.2.11 that lack attachment count limits, allowing DoS via messages with excessive attachments. The target version 3.5.9 already contains the upstream fix (commit 6c3990144b) that enforces a default limit of 50 attachments (configurable via ATTACHMENT_MAX_COUNT). This fix was authored by Apache CXF maintainer Colm O hEigeartaigh and sh..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/apache-cxf@3.5.9-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.apache.cxf/apache-cxf@3.5.9-tuxcare.4" } } ], "timestamp": "2026-11-04T09:04:11.456857+00:00", "status_notes": "Vulnerability CVE-2019-12423 does not affect version 3.5.9-tuxcare.4 of org.apache.cxf:apache-cxf. CVE-2019-12423 is NOT present in Apache CXF 3.5.9-tuxcare.10. The vulnerability (exposure of private keys when using JWK keystores) was fixed by upstream commit 6852cd5e49 authored by coheigea@apache.org, which shipped in the upstream release that this TuxCare branch is based on. The fix adds stripPrivateParameters logic that filters out secret keys (oct type) and removes RSA private key parameters (d, p, q, dp, dq, qi) before returning keys via the OIDC/JWK keys service. The defense is active by default (stripPrivateParameters=true) in JwksService, which OidcKeysService extends.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.12; >= 3.3.0, < 3.3.5; < 3.2.12; >= 3.3.0, < 3.3.5), NVD (< 3.2.12; >= 3.3.0, < 3.3.5), cve.org (< 3.3.5; < 3.2.12), Snyk (< 3.2.12; >= 3.3.0, < 3.3.5).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-12423" }, "impact_statement": "CVE-2019-12423 is NOT present in Apache CXF 3.5.9-tuxcare.10. The vulnerability (exposure of private keys when using JWK keystores) was fixed by upstream commit 6852cd5e49 authored by coheigea@apache.org, which shipped in the upstream release that this TuxCare branch is based on. The fix adds stripPrivateParameters logic that filters out secret keys (oct type) and removes RSA private key parameters (d, p, q, dp, dq, qi) before returning keys via the OIDC/JWK keys service. The defense is active by default (stripPrivateParameters=true) in JwksService, which OidcKeysService extends.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.12; >= 3.3.0, < 3.3.5; < 3.2.12; >= 3.3.0, < 3.3.5), NVD (< 3.2.12; >= 3.3.0, < 3.3.5), cve.org (< 3.3.5; < 3.2.12), Snyk (< 3.2.12; >= 3.3.0, < 3.3.5)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/apache-cxf@3.5.9-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.apache.cxf/apache-cxf@3.5.9-tuxcare.4" } } ], "timestamp": "2026-11-02T17:34:00.131982+00:00", "status_notes": "Vulnerability CVE-2019-17573 does not affect version 3.5.9-tuxcare.4 of org.apache.cxf:apache-cxf. not_affected \u2014 The target Apache CXF 3.5.9 is not affected by CVE-2019-17573 (reflected XSS in services listing page). The vulnerability was fixed by upstream Apache CXF in December 2019 (commit 4ca5f7b921 by coheigea@apache.org), which added HTML entity escaping to all URL/address outputs in the service listing pages. This fix was already present in the Apache CXF 3.5.9 release that TuxCare onboarded, as con...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17573" }, "impact_statement": "not_affected \u2014 The target Apache CXF 3.5.9 is not affected by CVE-2019-17573 (reflected XSS in services listing page). The vulnerability was fixed by upstream Apache CXF in December 2019 (commit 4ca5f7b921 by coheigea@apache.org), which added HTML entity escaping to all URL/address outputs in the service listing pages. This fix was already present in the Apache CXF 3.5.9 release that TuxCare onboarded, as con..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/apache-cxf@3.5.9-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.apache.cxf/apache-cxf@3.5.9-tuxcare.4" } } ], "timestamp": "2026-11-02T17:34:00.131982+00:00", "status_notes": "Vulnerability CVE-2020-13954 does not affect version 3.5.9-tuxcare.4 of org.apache.cxf:apache-cxf. not_affected \u2014 CVE-2020-13954 (reflected XSS via styleSheetPath in /services page) is NOT present in target Apache CXF 3.5.9-tuxcare.10. The vulnerable pattern was removed by upstream Apache fixes (commits 3c23fa3b3c and 1cf50e500c) that shipped in the 3.5.9 release before TuxCare's involvement. The target contains both required defenses: HTML escaping via StringEscapeUtils.escapeHtml4() and multiple-slash st...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-13954" }, "impact_statement": "not_affected \u2014 CVE-2020-13954 (reflected XSS via styleSheetPath in /services page) is NOT present in target Apache CXF 3.5.9-tuxcare.10. The vulnerable pattern was removed by upstream Apache fixes (commits 3c23fa3b3c and 1cf50e500c) that shipped in the 3.5.9 release before TuxCare's involvement. The target contains both required defenses: HTML escaping via StringEscapeUtils.escapeHtml4() and multiple-slash st..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/apache-cxf@3.5.9-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.apache.cxf/apache-cxf@3.5.9-tuxcare.4" } } ], "timestamp": "2026-11-04T09:04:11.456857+00:00", "status_notes": "Vulnerability CVE-2021-22696 does not affect version 3.5.9-tuxcare.4 of org.apache.cxf:apache-cxf. The target Apache CXF 3.5.9-tuxcare.10 is NOT AFFECTED by CVE-2021-22696. The vulnerability was fixed in the upstream Apache CXF 3.4.3 release, and version 3.5.9 already contains the complete fix. The vulnerable code pattern (weak request_uri validation that only checked for https://) has been replaced with secure code that disables request_uri handling by default. The fix was authored by Apache committer coheigea@apache.org and shipped in the upstream release that TuxCare later onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.4.0, < 3.4.3; < 3.3.10; >= 3.4.0, < 3.4.3; < 3.3.10), NVD (< 3.3.10; >= 3.4.0, < 3.4.3), cve.org (< 3.4.3; < 3.3.10), Snyk (< 3.3.10; >= 3.4.0, < 3.4.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-22696" }, "impact_statement": "The target Apache CXF 3.5.9-tuxcare.10 is NOT AFFECTED by CVE-2021-22696. The vulnerability was fixed in the upstream Apache CXF 3.4.3 release, and version 3.5.9 already contains the complete fix. The vulnerable code pattern (weak request_uri validation that only checked for https://) has been replaced with secure code that disables request_uri handling by default. The fix was authored by Apache committer coheigea@apache.org and shipped in the upstream release that TuxCare later onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.4.0, < 3.4.3; < 3.3.10; >= 3.4.0, < 3.4.3; < 3.3.10), NVD (< 3.3.10; >= 3.4.0, < 3.4.3), cve.org (< 3.4.3; < 3.3.10), Snyk (< 3.3.10; >= 3.4.0, < 3.4.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/apache-cxf@3.5.9-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.apache.cxf/apache-cxf@3.5.9-tuxcare.4" } } ], "timestamp": "2026-11-04T09:03:00.104314+00:00", "status_notes": "Vulnerability CVE-2021-30468 does not affect version 3.5.9-tuxcare.4 of org.apache.cxf:apache-cxf. Apache CXF 3.5.9-tuxcare.10 is not affected by CVE-2021-30468. The vulnerability affected versions prior to 3.4.4 and 3.3.11 due to missing JSON escaping in JsonMapObjectReaderWriter, which allowed malformed JSON to cause infinite loops. The target version 3.5.9 already includes the upstream fix (commit fa01cfac79 by coheigea@apache.org) that adds proper JSON escaping via the escapeJson() method. This fix was present in the upstream Apache CXF release before TuxCare's ELS work began, making the vulnerable code pattern absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.4.0, < 3.4.4; < 3.3.11; >= 3.4.0, < 3.4.4; < 3.3.11), NVD (< 3.3.11; >= 3.4.0, < 3.4.4), cve.org (< 3.3.11), Snyk (>= 3.4.0, < 3.4.4; < 3.3.11).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-30468" }, "impact_statement": "Apache CXF 3.5.9-tuxcare.10 is not affected by CVE-2021-30468. The vulnerability affected versions prior to 3.4.4 and 3.3.11 due to missing JSON escaping in JsonMapObjectReaderWriter, which allowed malformed JSON to cause infinite loops. The target version 3.5.9 already includes the upstream fix (commit fa01cfac79 by coheigea@apache.org) that adds proper JSON escaping via the escapeJson() method. This fix was present in the upstream Apache CXF release before TuxCare's ELS work began, making the vulnerable code pattern absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.4.0, < 3.4.4; < 3.3.11; >= 3.4.0, < 3.4.4; < 3.3.11), NVD (< 3.3.11; >= 3.4.0, < 3.4.4), cve.org (< 3.3.11), Snyk (>= 3.4.0, < 3.4.4; < 3.3.11)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.cxf/apache-cxf@3.5.9-tuxcare.4", "identifiers": { "purl": "pkg:maven/org.apache.cxf/apache-cxf@3.5.9-tuxcare.4" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2025-15104 is a false positive for org.apache.cxf:apache-cxf 3.5.9-tuxcare.4. direct vulnerability is in Nu Html Checker (validator.nu) project", "vulnerability": { "name": "CVE-2025-15104" }, "impact_statement": "direct vulnerability is in Nu Html Checker (validator.nu) project" } ] }