{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:14000634-6ae7-54d7-b5bc-5f5c2ca199d1", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-producer-cache-caffeine@0.5.10-tuxcare.1", "type": "library", "group": "org.apache.pulsar", "name": "pulsar-client-reactive-producer-cache-caffeine", "version": "0.5.10-tuxcare.1", "purl": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-producer-cache-caffeine@0.5.10-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:d660fbce-66d7-5ef9-b7fd-84ebd9a3fa0a", "id": "CVE-2021-22160", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2021-22160 is a false positive for org.apache.pulsar:pulsar-client-reactive-producer-cache-caffeine 0.5.10-tuxcare.1. Wrong-project match. CVE-2021-22160 concerns Apache Pulsar SERVER's JWT authentication validation (broker component), while this repository is pulsar-client-reactive 0.5.10, a reactive CLIENT library that connects TO Pulsar servers. The vulnerable server-side JWT validation code is completely absent from this client-only repository." }, "affects": [ { "ref": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-producer-cache-caffeine@0.5.10-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b58399c9-1411-571b-bd7b-0c5696a0d616", "id": "CVE-2022-24280", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-24280 is a false positive for org.apache.pulsar:pulsar-client-reactive-producer-cache-caffeine 0.5.10-tuxcare.1. false_positive \u2014 CVE-2022-24280 targets the Apache Pulsar Proxy server component, but the target repository (pulsar-client-reactive v0.5.10) is a client library. The provided patch only upgrades dependency versions in build configuration files. Exhaustive searches found zero proxy-related code in the target repository - no proxy classes, packages (org.apache.pulsar.proxy), or server components. The repository o..." }, "affects": [ { "ref": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-producer-cache-caffeine@0.5.10-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f10bb6dd-b64e-5c92-9321-a11f8656404c", "id": "CVE-2022-33681", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-33681 does not affect version 0.5.10-tuxcare.1 of org.apache.pulsar:pulsar-client-reactive-producer-cache-caffeine. not_affected \u2014 The target repository (apache/pulsar-client-reactive v0.5.10) is NOT AFFECTED by CVE-2022-33681. This is a reactive wrapper library that does not contain the vulnerable TLS hostname verification code. The vulnerability exists only in the underlying Apache Pulsar client dependency (org.apache.pulsar:pulsar-client), and the target depends on version 3.3.3, which is well beyond the vulnerable vers..." }, "affects": [ { "ref": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-producer-cache-caffeine@0.5.10-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:bbcd3eac-df43-5b93-87b8-6f1629cb9ff2", "id": "CVE-2022-33682", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-33682 does not affect version 0.5.10-tuxcare.1 of org.apache.pulsar:pulsar-client-reactive-producer-cache-caffeine. not_affected \u2014 CVE-2022-33682 affects TLS hostname verification in Apache Pulsar Java client versions \u22642.10.0, fixed in 2.10.2+. The target repository (pulsar-client-reactive v0.5.10) is a reactive wrapper that delegates all TLS/connection handling to the underlying Pulsar Java client library. The target depends on Pulsar 3.3.3 (gradle/libs.versions.toml:32), which is well beyond the fixed version. The vulner..." }, "affects": [ { "ref": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-producer-cache-caffeine@0.5.10-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:644ee6a6-5c21-5bcb-8627-af9ebc62457c", "id": "CVE-2022-33683", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-33683 is a false positive for org.apache.pulsar:pulsar-client-reactive-producer-cache-caffeine 0.5.10-tuxcare.1. false_positive \u2014 CVE-2022-33683 affects Apache Pulsar Broker and Proxy server components, specifically how they initialize their internal Admin Client with insecure TLS configuration. The target repository (pulsar-client-reactive v0.5.10) is a CLIENT library wrapper for reactive programming that contains ZERO Broker, Proxy, or Admin Client code. This is a wrong-project match: the CVE targets server-side compone..." }, "affects": [ { "ref": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-producer-cache-caffeine@0.5.10-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:83ae5ad5-ce7f-5e49-8cea-7118cae99e36", "id": "CVE-2022-33684", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-33684 is a false positive for org.apache.pulsar:pulsar-client-reactive-producer-cache-caffeine 0.5.10-tuxcare.1. false_positive \u2014 CVE-2022-33684 is in the Apache Pulsar C++ client library (pulsar-client-cpp/lib/auth/AuthOauth2.cc, fix apache/pulsar#16064), shipped only as the pip wheel pulsar-client; GHSA-5r3h-c3r7-9w4h lists no Maven package. pulsar-client-reactive is a different library and the vulnerable code is absent from its whole dependency closure (18 jars, 13 native binaries, 0 curl/OAuth2 symbols). PoC (poc/CVE-2022-33684): C++ 2.10.1 leaked client_secret to a rogue issuer, the Java stack refused at that same 2.10.1 and at 3.3.3." }, "affects": [ { "ref": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-producer-cache-caffeine@0.5.10-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b9c15b4e-95c9-5478-b2fa-0d5095ae673d", "id": "CVE-2023-30429", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2023-30429 is a false positive for org.apache.pulsar:pulsar-client-reactive-producer-cache-caffeine 0.5.10-tuxcare.1. CVE-2023-30429 is a wrong-project match. The CVE concerns authorization logic in the Apache Pulsar Function Worker (server-side component), but this repository is `pulsar-client-reactive` v0.5.10, a CLIENT library for connecting to Pulsar servers. The repository contains zero server-side code, no Function Worker components, and no vendored copies of the affected component. This is a wrong-project match." }, "affects": [ { "ref": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-producer-cache-caffeine@0.5.10-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:7568863c-f930-5568-be00-a7ef4fe75672", "id": "CVE-2023-31007", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2023-31007 is a false positive for org.apache.pulsar:pulsar-client-reactive-producer-cache-caffeine 0.5.10-tuxcare.1. false_positive \u2014 CVE-2023-31007 is a false positive for this repository. The CVE affects Apache Pulsar Broker (server-side authentication component), but this repository is Apache Pulsar Reactive Client v0.5.10 (client library). The vulnerable component code is completely absent from this repository - no broker code, no authenticateOriginalAuthData configuration, and no authentication expiration logic exists in..." }, "affects": [ { "ref": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-producer-cache-caffeine@0.5.10-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:05db32e3-1b93-5d47-903a-b6c8bf32d2fa", "id": "CVE-2023-37544", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2023-37544 is a false positive for org.apache.pulsar:pulsar-client-reactive-producer-cache-caffeine 0.5.10-tuxcare.1. CVE-2023-37544 describes a vulnerability in Apache Pulsar WebSocket Proxy server component's /pingpong endpoint. pulsar-client-reactive is a reactive client library for Apache Pulsar, not the WebSocket Proxy server. It contains no WebSocket Proxy code, no /pingpong endpoint and no server-side WebSocket handling: all of its sources live under org/apache/pulsar/reactive/client, and its only Apache Pulsar dependencies are org.apache.pulsar:pulsar-client-api and the shaded org.apache.pulsar:pulsar-client, neither of which carries the WebSocket Proxy. The vulnerability therefore does not apply to this library in any version." }, "affects": [ { "ref": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-producer-cache-caffeine@0.5.10-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6dbc41c5-81b9-588c-a09a-a3ee4fe44dae", "id": "CVE-2023-37579", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2023-37579 is a false positive for org.apache.pulsar:pulsar-client-reactive-producer-cache-caffeine 0.5.10-tuxcare.1. CVE-2023-37579 is a wrong-project match. The CVE affects the Apache Pulsar Function Worker (server-side component that manages Pulsar Functions, Sources, and Sinks), but this repository is the Apache Pulsar Reactive Client library (version 0.5.10), a client-side library for reactive messaging. The vulnerable component (Function Worker with its admin REST API endpoints for source/sink configuration retrieval) is completely absent from this repository, its source code, and all dependencies." }, "affects": [ { "ref": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-producer-cache-caffeine@0.5.10-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:960373f3-95ea-53c1-8d8a-df90f6064fe9", "id": "CVE-2023-51437", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2023-51437 is a false positive for org.apache.pulsar:pulsar-client-reactive-producer-cache-caffeine 0.5.10-tuxcare.1. CVE-2023-51437 is a false positive for this repository. The CVE affects the Apache Pulsar SASL Authentication Provider in server-side components (Broker, Proxy, Websocket Proxy, Function Worker). This repository is pulsar-client-reactive version 0.5.10, a client library that provides Reactive Streams adapter for the Apache Pulsar Java client. The vulnerable server-side SASL authentication provider code does not exist anywhere in this client library codebase." }, "affects": [ { "ref": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-producer-cache-caffeine@0.5.10-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.apache.pulsar/pulsar-client-reactive-producer-cache-caffeine@0.5.10-tuxcare.1" } ] }