{
  "@id": "urn:uuid:1242aee7-bf7a-4256-bc5f-cb0026d594d3",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-08T23:03:00.144150+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.wildfly.security/wildfly-elytron@1.12.1.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.wildfly.security/wildfly-elytron@1.12.1.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-08T23:02:29.321141+00:00",
      "status_notes": "Vulnerability CVE-2015-5186 is a false positive for org.wildfly.security:wildfly-elytron 1.12.1.Final-tuxcare.1. false_positive \u2014 CVE-2015-5186 concerns the Linux Audit subsystem (auditd/libaudit) version < 2.4.4, a C-based Linux kernel/userspace component that logs system calls and security events at the OS level. The target repository is WildFly Elytron 1.12.1.Final, a Java-based security framework for authentication and authorization. This is a wrong-project match caused by both projects using the term \"audit\" in their...",
      "vulnerability": {
        "name": "CVE-2015-5186"
      },
      "impact_statement": "false_positive \u2014 CVE-2015-5186 concerns the Linux Audit subsystem (auditd/libaudit) version < 2.4.4, a C-based Linux kernel/userspace component that logs system calls and security events at the OS level. The target repository is WildFly Elytron 1.12.1.Final, a Java-based security framework for authentication and authorization. This is a wrong-project match caused by both projects using the term \"audit\" in their..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.wildfly.security/wildfly-elytron@1.12.1.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.wildfly.security/wildfly-elytron@1.12.1.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-08T23:02:29.321141+00:00",
      "status_notes": "Vulnerability CVE-2020-10714 does not affect version 1.12.1.Final-tuxcare.1 of org.wildfly.security:wildfly-elytron. Target repository version 1.12.1.Final is not affected by CVE-2020-10714. The CVE affects WildFly Elytron \"version 1.11.3.Final and before\" for a session fixation vulnerability in FORM authentication. All upstream security fixes (ELY-1950 and ELY-1945) were applied in April 2020 by upstream author Darran Lofthouse and shipped in the 1.12.1.Final release (June 2020). TuxCare onboarded this already-patched version. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.11.4), NVD (< 1.11.3), cve.org (= 1.10.7.Final), Snyk (< 1.6.7.Final; >= 1.7.0.CR1, < 1.11.4.Final).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-10714"
      },
      "impact_statement": "Target repository version 1.12.1.Final is not affected by CVE-2020-10714. The CVE affects WildFly Elytron \"version 1.11.3.Final and before\" for a session fixation vulnerability in FORM authentication. All upstream security fixes (ELY-1950 and ELY-1945) were applied in April 2020 by upstream author Darran Lofthouse and shipped in the 1.12.1.Final release (June 2020). TuxCare onboarded this already-patched version. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.11.4), NVD (< 1.11.3), cve.org (= 1.10.7.Final), Snyk (< 1.6.7.Final; >= 1.7.0.CR1, < 1.11.4.Final)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.wildfly.security/wildfly-elytron@1.12.1.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.wildfly.security/wildfly-elytron@1.12.1.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-08T23:03:00.144150+00:00",
      "status_notes": "Vulnerability CVE-2020-1748 is fixed in version 1.12.1.Final-tuxcare.1 of org.wildfly.security:wildfly-elytron.",
      "vulnerability": {
        "name": "CVE-2020-1748"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.wildfly.security/wildfly-elytron@1.12.1.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.wildfly.security/wildfly-elytron@1.12.1.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-08T23:02:29.321141+00:00",
      "status_notes": "Vulnerability CVE-2021-3642 affects version 1.12.1.Final-tuxcare.1 of org.wildfly.security:wildfly-elytron.",
      "vulnerability": {
        "name": "CVE-2021-3642"
      },
      "action_statement": "Vulnerability CVE-2021-3642 affects version 1.12.1.Final-tuxcare.1 of org.wildfly.security:wildfly-elytron."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.wildfly.security/wildfly-elytron@1.12.1.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.wildfly.security/wildfly-elytron@1.12.1.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-08T23:02:29.321141+00:00",
      "status_notes": "Vulnerability CVE-2022-3143 affects version 1.12.1.Final-tuxcare.1 of org.wildfly.security:wildfly-elytron.",
      "vulnerability": {
        "name": "CVE-2022-3143"
      },
      "action_statement": "Vulnerability CVE-2022-3143 affects version 1.12.1.Final-tuxcare.1 of org.wildfly.security:wildfly-elytron."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.wildfly.security/wildfly-elytron@1.12.1.Final-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.wildfly.security/wildfly-elytron@1.12.1.Final-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-08T23:02:29.321141+00:00",
      "status_notes": "Vulnerability CVE-2024-12369 does not affect version 1.12.1.Final-tuxcare.1 of org.wildfly.security:wildfly-elytron. not_affected \u2014 Target version 1.12.1.Final is NOT AFFECTED by CVE-2024-12369. The vulnerability affects the OIDC (OpenID Connect) client module in wildfly-elytron, but this module does not exist in version 1.12.1.Final. The OIDC client functionality was first introduced in version 1.15.7.Final, which is 4 minor versions later than the target. Since the vulnerable component (http/oidc module and all OIDC autho...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-12369"
      },
      "impact_statement": "not_affected \u2014 Target version 1.12.1.Final is NOT AFFECTED by CVE-2024-12369. The vulnerability affects the OIDC (OpenID Connect) client module in wildfly-elytron, but this module does not exist in version 1.12.1.Final. The OIDC client functionality was first introduced in version 1.15.7.Final, which is 4 minor versions later than the target. Since the vulnerable component (http/oidc module and all OIDC autho..."
    }
  ]
}