{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a68c153e-92ea-5a93-9def-ef3a52362edb", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-bom@0.5.10-tuxcare.2", "type": "library", "group": "org.apache.pulsar", "name": "pulsar-client-reactive-bom", "version": "0.5.10-tuxcare.2", "purl": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-bom@0.5.10-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:af2b30a8-37a5-52ca-b047-6b27327f0ffe", "id": "CVE-2021-22160", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2021-22160 is a false positive for org.apache.pulsar:pulsar-client-reactive-bom 0.5.10-tuxcare.2. Wrong-project match. CVE-2021-22160 concerns Apache Pulsar SERVER's JWT authentication validation (broker component), while this repository is pulsar-client-reactive 0.5.10, a reactive CLIENT library that connects TO Pulsar servers. The vulnerable server-side JWT validation code is completely absent from this client-only repository." }, "affects": [ { "ref": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-bom@0.5.10-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c1984601-8041-58d4-8699-e0408fc42c0b", "id": "CVE-2022-24280", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-24280 is a false positive for org.apache.pulsar:pulsar-client-reactive-bom 0.5.10-tuxcare.2. false_positive \u2014 CVE-2022-24280 targets the Apache Pulsar Proxy server component, but the target repository (pulsar-client-reactive v0.5.10) is a client library. The provided patch only upgrades dependency versions in build configuration files. Exhaustive searches found zero proxy-related code in the target repository - no proxy classes, packages (org.apache.pulsar.proxy), or server components. The repository o..." }, "affects": [ { "ref": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-bom@0.5.10-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:1df8a1a4-a00c-5241-a467-68b4cc478435", "id": "CVE-2022-33681", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-33681 does not affect version 0.5.10-tuxcare.2 of org.apache.pulsar:pulsar-client-reactive-bom. not_affected \u2014 The target repository (apache/pulsar-client-reactive v0.5.10) is NOT AFFECTED by CVE-2022-33681. This is a reactive wrapper library that does not contain the vulnerable TLS hostname verification code. The vulnerability exists only in the underlying Apache Pulsar client dependency (org.apache.pulsar:pulsar-client), and the target depends on version 3.3.3, which is well beyond the vulnerable vers..." }, "affects": [ { "ref": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-bom@0.5.10-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:2bb4d8de-40f9-5f77-85dd-25881df8c219", "id": "CVE-2022-33682", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-33682 does not affect version 0.5.10-tuxcare.2 of org.apache.pulsar:pulsar-client-reactive-bom. not_affected \u2014 CVE-2022-33682 affects TLS hostname verification in Apache Pulsar Java client versions \u22642.10.0, fixed in 2.10.2+. The target repository (pulsar-client-reactive v0.5.10) is a reactive wrapper that delegates all TLS/connection handling to the underlying Pulsar Java client library. The target depends on Pulsar 3.3.3 (gradle/libs.versions.toml:32), which is well beyond the fixed version. The vulner..." }, "affects": [ { "ref": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-bom@0.5.10-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:fedb4ab9-8d63-510a-a270-04b0f58892ed", "id": "CVE-2022-33683", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-33683 is a false positive for org.apache.pulsar:pulsar-client-reactive-bom 0.5.10-tuxcare.2. false_positive \u2014 CVE-2022-33683 affects Apache Pulsar Broker and Proxy server components, specifically how they initialize their internal Admin Client with insecure TLS configuration. The target repository (pulsar-client-reactive v0.5.10) is a CLIENT library wrapper for reactive programming that contains ZERO Broker, Proxy, or Admin Client code. This is a wrong-project match: the CVE targets server-side compone..." }, "affects": [ { "ref": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-bom@0.5.10-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:5a73ba41-9b25-54a3-929f-c7bf9ae7159e", "id": "CVE-2022-33684", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-33684 is a false positive for org.apache.pulsar:pulsar-client-reactive-bom 0.5.10-tuxcare.2. false_positive \u2014 CVE-2022-33684 is in the Apache Pulsar C++ client library (pulsar-client-cpp/lib/auth/AuthOauth2.cc, fix apache/pulsar#16064), shipped only as the pip wheel pulsar-client; GHSA-5r3h-c3r7-9w4h lists no Maven package. pulsar-client-reactive is a different library and the vulnerable code is absent from its whole dependency closure (18 jars, 13 native binaries, 0 curl/OAuth2 symbols). PoC (poc/CVE-2022-33684): C++ 2.10.1 leaked client_secret to a rogue issuer, the Java stack refused at that same 2.10.1 and at 3.3.3." }, "affects": [ { "ref": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-bom@0.5.10-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:2aa0eded-7881-51cc-a5a0-c7ca7179872f", "id": "CVE-2023-30429", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2023-30429 is a false positive for org.apache.pulsar:pulsar-client-reactive-bom 0.5.10-tuxcare.2. CVE-2023-30429 is a wrong-project match. The CVE concerns authorization logic in the Apache Pulsar Function Worker (server-side component), but this repository is `pulsar-client-reactive` v0.5.10, a CLIENT library for connecting to Pulsar servers. The repository contains zero server-side code, no Function Worker components, and no vendored copies of the affected component. This is a wrong-project match." }, "affects": [ { "ref": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-bom@0.5.10-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:43787f65-ff2a-5d10-a3e3-cf81363d04f3", "id": "CVE-2023-31007", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2023-31007 is a false positive for org.apache.pulsar:pulsar-client-reactive-bom 0.5.10-tuxcare.2. false_positive \u2014 CVE-2023-31007 is a false positive for this repository. The CVE affects Apache Pulsar Broker (server-side authentication component), but this repository is Apache Pulsar Reactive Client v0.5.10 (client library). The vulnerable component code is completely absent from this repository - no broker code, no authenticateOriginalAuthData configuration, and no authentication expiration logic exists in..." }, "affects": [ { "ref": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-bom@0.5.10-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:8527a513-8c4b-53f4-9f07-371696d63aa1", "id": "CVE-2023-37544", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2023-37544 is a false positive for org.apache.pulsar:pulsar-client-reactive-bom 0.5.10-tuxcare.2. CVE-2023-37544 describes a vulnerability in Apache Pulsar WebSocket Proxy server component's /pingpong endpoint. pulsar-client-reactive is a reactive client library for Apache Pulsar, not the WebSocket Proxy server. It contains no WebSocket Proxy code, no /pingpong endpoint and no server-side WebSocket handling: all of its sources live under org/apache/pulsar/reactive/client, and its only Apache Pulsar dependencies are org.apache.pulsar:pulsar-client-api and the shaded org.apache.pulsar:pulsar-client, neither of which carries the WebSocket Proxy. The vulnerability therefore does not apply to this library in any version." }, "affects": [ { "ref": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-bom@0.5.10-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:cb70b864-bbaa-5d9d-b13a-38b5f12ec9c7", "id": "CVE-2023-37579", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2023-37579 is a false positive for org.apache.pulsar:pulsar-client-reactive-bom 0.5.10-tuxcare.2. CVE-2023-37579 is a wrong-project match. The CVE affects the Apache Pulsar Function Worker (server-side component that manages Pulsar Functions, Sources, and Sinks), but this repository is the Apache Pulsar Reactive Client library (version 0.5.10), a client-side library for reactive messaging. The vulnerable component (Function Worker with its admin REST API endpoints for source/sink configuration retrieval) is completely absent from this repository, its source code, and all dependencies." }, "affects": [ { "ref": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-bom@0.5.10-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:55e794f8-453a-5b2e-8012-0a76acf90f09", "id": "CVE-2023-51437", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2023-51437 is a false positive for org.apache.pulsar:pulsar-client-reactive-bom 0.5.10-tuxcare.2. CVE-2023-51437 is a false positive for this repository. The CVE affects the Apache Pulsar SASL Authentication Provider in server-side components (Broker, Proxy, Websocket Proxy, Function Worker). This repository is pulsar-client-reactive version 0.5.10, a client library that provides Reactive Streams adapter for the Apache Pulsar Java client. The vulnerable server-side SASL authentication provider code does not exist anywhere in this client library codebase." }, "affects": [ { "ref": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-bom@0.5.10-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-bom@0.5.10-tuxcare.2" } ] }