{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:0dfddb18-ef99-5c09-8a88-160d76573170", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-bom@0.5.10-tuxcare.1", "type": "library", "group": "org.apache.pulsar", "name": "pulsar-client-reactive-bom", "version": "0.5.10-tuxcare.1", "purl": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-bom@0.5.10-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:3a7cf995-51e4-5c1e-828f-2c73a26cd5a7", "id": "CVE-2021-22160", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2021-22160 is a false positive for org.apache.pulsar:pulsar-client-reactive-bom 0.5.10-tuxcare.1. Wrong-project match. CVE-2021-22160 concerns Apache Pulsar SERVER's JWT authentication validation (broker component), while this repository is pulsar-client-reactive 0.5.10, a reactive CLIENT library that connects TO Pulsar servers. The vulnerable server-side JWT validation code is completely absent from this client-only repository." }, "affects": [ { "ref": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-bom@0.5.10-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:434ccba7-8f4f-5998-ba4a-a87cddff90a2", "id": "CVE-2022-24280", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-24280 is a false positive for org.apache.pulsar:pulsar-client-reactive-bom 0.5.10-tuxcare.1. false_positive \u2014 CVE-2022-24280 targets the Apache Pulsar Proxy server component, but the target repository (pulsar-client-reactive v0.5.10) is a client library. The provided patch only upgrades dependency versions in build configuration files. Exhaustive searches found zero proxy-related code in the target repository - no proxy classes, packages (org.apache.pulsar.proxy), or server components. The repository o..." }, "affects": [ { "ref": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-bom@0.5.10-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:04b278de-8621-54cd-9b3a-ffcba72377bd", "id": "CVE-2022-33681", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-33681 does not affect version 0.5.10-tuxcare.1 of org.apache.pulsar:pulsar-client-reactive-bom. not_affected \u2014 The target repository (apache/pulsar-client-reactive v0.5.10) is NOT AFFECTED by CVE-2022-33681. This is a reactive wrapper library that does not contain the vulnerable TLS hostname verification code. The vulnerability exists only in the underlying Apache Pulsar client dependency (org.apache.pulsar:pulsar-client), and the target depends on version 3.3.3, which is well beyond the vulnerable vers..." }, "affects": [ { "ref": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-bom@0.5.10-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9f7e0290-9f7c-5355-8ca3-103132e0aa12", "id": "CVE-2022-33682", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-33682 does not affect version 0.5.10-tuxcare.1 of org.apache.pulsar:pulsar-client-reactive-bom. not_affected \u2014 CVE-2022-33682 affects TLS hostname verification in Apache Pulsar Java client versions \u22642.10.0, fixed in 2.10.2+. The target repository (pulsar-client-reactive v0.5.10) is a reactive wrapper that delegates all TLS/connection handling to the underlying Pulsar Java client library. The target depends on Pulsar 3.3.3 (gradle/libs.versions.toml:32), which is well beyond the fixed version. The vulner..." }, "affects": [ { "ref": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-bom@0.5.10-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:478d98d4-fc15-5343-a8e7-58cfc7bd0ffb", "id": "CVE-2022-33683", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-33683 is a false positive for org.apache.pulsar:pulsar-client-reactive-bom 0.5.10-tuxcare.1. false_positive \u2014 CVE-2022-33683 affects Apache Pulsar Broker and Proxy server components, specifically how they initialize their internal Admin Client with insecure TLS configuration. The target repository (pulsar-client-reactive v0.5.10) is a CLIENT library wrapper for reactive programming that contains ZERO Broker, Proxy, or Admin Client code. This is a wrong-project match: the CVE targets server-side compone..." }, "affects": [ { "ref": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-bom@0.5.10-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:33fb8611-be8d-55af-b68b-0d5c09c0a550", "id": "CVE-2022-33684", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-33684 is a false positive for org.apache.pulsar:pulsar-client-reactive-bom 0.5.10-tuxcare.1. false_positive \u2014 CVE-2022-33684 is in the Apache Pulsar C++ client library (pulsar-client-cpp/lib/auth/AuthOauth2.cc, fix apache/pulsar#16064), shipped only as the pip wheel pulsar-client; GHSA-5r3h-c3r7-9w4h lists no Maven package. pulsar-client-reactive is a different library and the vulnerable code is absent from its whole dependency closure (18 jars, 13 native binaries, 0 curl/OAuth2 symbols). PoC (poc/CVE-2022-33684): C++ 2.10.1 leaked client_secret to a rogue issuer, the Java stack refused at that same 2.10.1 and at 3.3.3." }, "affects": [ { "ref": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-bom@0.5.10-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:1740a7fc-6719-5cc8-8f6a-1007e5891a95", "id": "CVE-2023-30429", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2023-30429 is a false positive for org.apache.pulsar:pulsar-client-reactive-bom 0.5.10-tuxcare.1. CVE-2023-30429 is a wrong-project match. The CVE concerns authorization logic in the Apache Pulsar Function Worker (server-side component), but this repository is `pulsar-client-reactive` v0.5.10, a CLIENT library for connecting to Pulsar servers. The repository contains zero server-side code, no Function Worker components, and no vendored copies of the affected component. This is a wrong-project match." }, "affects": [ { "ref": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-bom@0.5.10-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d8b05e1e-0421-5a58-b216-fb40e2735441", "id": "CVE-2023-31007", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2023-31007 is a false positive for org.apache.pulsar:pulsar-client-reactive-bom 0.5.10-tuxcare.1. false_positive \u2014 CVE-2023-31007 is a false positive for this repository. The CVE affects Apache Pulsar Broker (server-side authentication component), but this repository is Apache Pulsar Reactive Client v0.5.10 (client library). The vulnerable component code is completely absent from this repository - no broker code, no authenticateOriginalAuthData configuration, and no authentication expiration logic exists in..." }, "affects": [ { "ref": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-bom@0.5.10-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d25eaca7-3930-5a56-a4ba-c2fee862b9b1", "id": "CVE-2023-37544", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2023-37544 is a false positive for org.apache.pulsar:pulsar-client-reactive-bom 0.5.10-tuxcare.1. CVE-2023-37544 describes a vulnerability in Apache Pulsar WebSocket Proxy server component's /pingpong endpoint. pulsar-client-reactive is a reactive client library for Apache Pulsar, not the WebSocket Proxy server. It contains no WebSocket Proxy code, no /pingpong endpoint and no server-side WebSocket handling: all of its sources live under org/apache/pulsar/reactive/client, and its only Apache Pulsar dependencies are org.apache.pulsar:pulsar-client-api and the shaded org.apache.pulsar:pulsar-client, neither of which carries the WebSocket Proxy. The vulnerability therefore does not apply to this library in any version." }, "affects": [ { "ref": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-bom@0.5.10-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:4581cadb-7cdd-51e2-924a-723664958d8e", "id": "CVE-2023-37579", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2023-37579 is a false positive for org.apache.pulsar:pulsar-client-reactive-bom 0.5.10-tuxcare.1. CVE-2023-37579 is a wrong-project match. The CVE affects the Apache Pulsar Function Worker (server-side component that manages Pulsar Functions, Sources, and Sinks), but this repository is the Apache Pulsar Reactive Client library (version 0.5.10), a client-side library for reactive messaging. The vulnerable component (Function Worker with its admin REST API endpoints for source/sink configuration retrieval) is completely absent from this repository, its source code, and all dependencies." }, "affects": [ { "ref": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-bom@0.5.10-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b49033b3-18e5-50f5-869c-f1e4bd561355", "id": "CVE-2023-51437", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2023-51437 is a false positive for org.apache.pulsar:pulsar-client-reactive-bom 0.5.10-tuxcare.1. CVE-2023-51437 is a false positive for this repository. The CVE affects the Apache Pulsar SASL Authentication Provider in server-side components (Broker, Proxy, Websocket Proxy, Function Worker). This repository is pulsar-client-reactive version 0.5.10, a client library that provides Reactive Streams adapter for the Apache Pulsar Java client. The vulnerable server-side SASL authentication provider code does not exist anywhere in this client library codebase." }, "affects": [ { "ref": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-bom@0.5.10-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-bom@0.5.10-tuxcare.1" } ] }