{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6f0ea0ca-f7d2-5c1e-9562-e9ca860ce6a9", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-jackson@0.5.10-tuxcare.2", "type": "library", "group": "org.apache.pulsar", "name": "pulsar-client-reactive-jackson", "version": "0.5.10-tuxcare.2", "purl": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-jackson@0.5.10-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:3d77661c-87e8-5b1c-a7ca-ddaf8b95695e", "id": "CVE-2021-22160", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2021-22160 is a false positive for org.apache.pulsar:pulsar-client-reactive-jackson 0.5.10-tuxcare.2. Wrong-project match. CVE-2021-22160 concerns Apache Pulsar SERVER's JWT authentication validation (broker component), while this repository is pulsar-client-reactive 0.5.10, a reactive CLIENT library that connects TO Pulsar servers. The vulnerable server-side JWT validation code is completely absent from this client-only repository." }, "affects": [ { "ref": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-jackson@0.5.10-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:2674dc78-fca3-5889-a46d-3653c5fd0452", "id": "CVE-2022-24280", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-24280 is a false positive for org.apache.pulsar:pulsar-client-reactive-jackson 0.5.10-tuxcare.2. false_positive \u2014 CVE-2022-24280 targets the Apache Pulsar Proxy server component, but the target repository (pulsar-client-reactive v0.5.10) is a client library. The provided patch only upgrades dependency versions in build configuration files. Exhaustive searches found zero proxy-related code in the target repository - no proxy classes, packages (org.apache.pulsar.proxy), or server components. The repository o..." }, "affects": [ { "ref": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-jackson@0.5.10-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:b17e282e-d180-51ca-aa93-1fc1621edc45", "id": "CVE-2022-33681", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-33681 does not affect version 0.5.10-tuxcare.2 of org.apache.pulsar:pulsar-client-reactive-jackson. not_affected \u2014 The target repository (apache/pulsar-client-reactive v0.5.10) is NOT AFFECTED by CVE-2022-33681. This is a reactive wrapper library that does not contain the vulnerable TLS hostname verification code. The vulnerability exists only in the underlying Apache Pulsar client dependency (org.apache.pulsar:pulsar-client), and the target depends on version 3.3.3, which is well beyond the vulnerable vers..." }, "affects": [ { "ref": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-jackson@0.5.10-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:bde28e4d-4dfb-5403-809a-58565f0eea34", "id": "CVE-2022-33682", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-33682 does not affect version 0.5.10-tuxcare.2 of org.apache.pulsar:pulsar-client-reactive-jackson. not_affected \u2014 CVE-2022-33682 affects TLS hostname verification in Apache Pulsar Java client versions \u22642.10.0, fixed in 2.10.2+. The target repository (pulsar-client-reactive v0.5.10) is a reactive wrapper that delegates all TLS/connection handling to the underlying Pulsar Java client library. The target depends on Pulsar 3.3.3 (gradle/libs.versions.toml:32), which is well beyond the fixed version. The vulner..." }, "affects": [ { "ref": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-jackson@0.5.10-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:be981ae5-9d34-5cdf-ad50-9794940a778a", "id": "CVE-2022-33683", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-33683 is a false positive for org.apache.pulsar:pulsar-client-reactive-jackson 0.5.10-tuxcare.2. false_positive \u2014 CVE-2022-33683 affects Apache Pulsar Broker and Proxy server components, specifically how they initialize their internal Admin Client with insecure TLS configuration. The target repository (pulsar-client-reactive v0.5.10) is a CLIENT library wrapper for reactive programming that contains ZERO Broker, Proxy, or Admin Client code. This is a wrong-project match: the CVE targets server-side compone..." }, "affects": [ { "ref": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-jackson@0.5.10-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:65f3d4a0-2b8d-5d86-97f2-48ea11ebc241", "id": "CVE-2022-33684", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-33684 is a false positive for org.apache.pulsar:pulsar-client-reactive-jackson 0.5.10-tuxcare.2. false_positive \u2014 CVE-2022-33684 is in the Apache Pulsar C++ client library (pulsar-client-cpp/lib/auth/AuthOauth2.cc, fix apache/pulsar#16064), shipped only as the pip wheel pulsar-client; GHSA-5r3h-c3r7-9w4h lists no Maven package. pulsar-client-reactive is a different library and the vulnerable code is absent from its whole dependency closure (18 jars, 13 native binaries, 0 curl/OAuth2 symbols). PoC (poc/CVE-2022-33684): C++ 2.10.1 leaked client_secret to a rogue issuer, the Java stack refused at that same 2.10.1 and at 3.3.3." }, "affects": [ { "ref": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-jackson@0.5.10-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:0cfbff4e-1557-59d0-ae9a-90748d19c9c9", "id": "CVE-2023-30429", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2023-30429 is a false positive for org.apache.pulsar:pulsar-client-reactive-jackson 0.5.10-tuxcare.2. CVE-2023-30429 is a wrong-project match. The CVE concerns authorization logic in the Apache Pulsar Function Worker (server-side component), but this repository is `pulsar-client-reactive` v0.5.10, a CLIENT library for connecting to Pulsar servers. The repository contains zero server-side code, no Function Worker components, and no vendored copies of the affected component. This is a wrong-project match." }, "affects": [ { "ref": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-jackson@0.5.10-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:6f483e14-4ce1-5b3e-9be4-4099de4a6861", "id": "CVE-2023-31007", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2023-31007 is a false positive for org.apache.pulsar:pulsar-client-reactive-jackson 0.5.10-tuxcare.2. false_positive \u2014 CVE-2023-31007 is a false positive for this repository. The CVE affects Apache Pulsar Broker (server-side authentication component), but this repository is Apache Pulsar Reactive Client v0.5.10 (client library). The vulnerable component code is completely absent from this repository - no broker code, no authenticateOriginalAuthData configuration, and no authentication expiration logic exists in..." }, "affects": [ { "ref": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-jackson@0.5.10-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:a729c5c9-e373-59ed-988b-cae2d7f5a0b1", "id": "CVE-2023-37544", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2023-37544 is a false positive for org.apache.pulsar:pulsar-client-reactive-jackson 0.5.10-tuxcare.2. CVE-2023-37544 describes a vulnerability in Apache Pulsar WebSocket Proxy server component's /pingpong endpoint. pulsar-client-reactive is a reactive client library for Apache Pulsar, not the WebSocket Proxy server. It contains no WebSocket Proxy code, no /pingpong endpoint and no server-side WebSocket handling: all of its sources live under org/apache/pulsar/reactive/client, and its only Apache Pulsar dependencies are org.apache.pulsar:pulsar-client-api and the shaded org.apache.pulsar:pulsar-client, neither of which carries the WebSocket Proxy. The vulnerability therefore does not apply to this library in any version." }, "affects": [ { "ref": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-jackson@0.5.10-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:ebeea0c9-c870-5d44-a274-139e02c20cd9", "id": "CVE-2023-37579", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2023-37579 is a false positive for org.apache.pulsar:pulsar-client-reactive-jackson 0.5.10-tuxcare.2. CVE-2023-37579 is a wrong-project match. The CVE affects the Apache Pulsar Function Worker (server-side component that manages Pulsar Functions, Sources, and Sinks), but this repository is the Apache Pulsar Reactive Client library (version 0.5.10), a client-side library for reactive messaging. The vulnerable component (Function Worker with its admin REST API endpoints for source/sink configuration retrieval) is completely absent from this repository, its source code, and all dependencies." }, "affects": [ { "ref": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-jackson@0.5.10-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:d5fc3bf7-01bf-5d5d-b8f0-240ca1abe176", "id": "CVE-2023-51437", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2023-51437 is a false positive for org.apache.pulsar:pulsar-client-reactive-jackson 0.5.10-tuxcare.2. CVE-2023-51437 is a false positive for this repository. The CVE affects the Apache Pulsar SASL Authentication Provider in server-side components (Broker, Proxy, Websocket Proxy, Function Worker). This repository is pulsar-client-reactive version 0.5.10, a client library that provides Reactive Streams adapter for the Apache Pulsar Java client. The vulnerable server-side SASL authentication provider code does not exist anywhere in this client library codebase." }, "affects": [ { "ref": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-jackson@0.5.10-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-jackson@0.5.10-tuxcare.2" } ] }