{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a49cfe17-19e7-5edb-aeee-3c1e25c0463e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-extras-juli", "purl": "pkg:maven/org.apache.tomcat.extras/tomcat-extras-juli@7.0.70-tuxcare.1", "type": "library", "group": "org.apache.tomcat.extras", "bom-ref": "pkg:maven/org.apache.tomcat.extras/tomcat-extras-juli@7.0.70-tuxcare.1", "version": "7.0.70-tuxcare.1", "pedigree": { "ancestors": [ { "name": "tomcat-extras-juli", "purl": "pkg:maven/org.apache.tomcat.extras/tomcat-extras-juli@7.0.70", "type": "library", "group": "org.apache.tomcat.extras", "version": "7.0.70" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2012-5568", "affects": [ { "ref": "pkg:maven/org.apache.tomcat.extras/tomcat-extras-juli@7.0.70-tuxcare.1" } ], "bom-ref": "urn:uuid:ca221cf1-d3b8-5b86-b844-59e79b0ed033", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5568 affects version 7.0.70-tuxcare.1 of org.apache.tomcat.extras:tomcat-extras-juli and will not be fixed. Apache does not treat CVE-2012-5568 as a Tomcat vulnerability and ships no fix; mitigation is connector configuration.", "response": [ "will_not_fix" ] } }, { "id": "CVE-2013-4590", "affects": [ { "ref": "pkg:maven/org.apache.tomcat.extras/tomcat-extras-juli@7.0.70-tuxcare.1" } ], "bom-ref": "urn:uuid:086e2b24-5278-53ba-9d10-3f85f0868eee", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-4590 does not affect version 7.0.70-tuxcare.1 of org.apache.tomcat.extras:tomcat-extras-juli. not_affected \u2014 Apache Tomcat 7.0.70 is not affected by CVE-2013-4590 (XXE vulnerability). The vulnerability affected Tomcat versions before 7.0.50. The target version 7.0.70 contains upstream Apache fixes (commits 78dd7e6f3d and f074781590) that implement and enable XXE protection by default. The LocalResolver entity resolver blocks external entities not in well-known whitelists, with xmlBlockExternal default...", "justification": "code_not_present" } }, { "id": "CVE-2015-5174", "affects": [ { "ref": "pkg:maven/org.apache.tomcat.extras/tomcat-extras-juli@7.0.70-tuxcare.1" } ], "bom-ref": "urn:uuid:98ff7535-25b7-5524-b26d-325e4adbaa81", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-5174 does not affect version 7.0.70-tuxcare.1 of org.apache.tomcat.extras:tomcat-extras-juli. CVE-2015-5174 affects Apache Tomcat 7.0.0-7.0.64", "justification": "code_not_present" } }, { "id": "CVE-2015-5346", "affects": [ { "ref": "pkg:maven/org.apache.tomcat.extras/tomcat-extras-juli@7.0.70-tuxcare.1" } ], "bom-ref": "urn:uuid:78ac2845-543e-56b3-9085-4abb3124afed", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-5346 does not affect version 7.0.70-tuxcare.1 of org.apache.tomcat.extras:tomcat-extras-juli. CVE-2015-5346 affects Apache Tomcat 7.0.5-7.0.65", "justification": "code_not_present" } }, { "id": "CVE-2016-0706", "affects": [ { "ref": "pkg:maven/org.apache.tomcat.extras/tomcat-extras-juli@7.0.70-tuxcare.1" } ], "bom-ref": "urn:uuid:9def18c6-3714-5a47-b368-fae8f1f56874", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-0706 does not affect version 7.0.70-tuxcare.1 of org.apache.tomcat.extras:tomcat-extras-juli. CVE-2016-0706 affects Apache Tomcat 7.0.0-7.0.67", "justification": "code_not_present" } }, { "id": "CVE-2016-0763", "affects": [ { "ref": "pkg:maven/org.apache.tomcat.extras/tomcat-extras-juli@7.0.70-tuxcare.1" } ], "bom-ref": "urn:uuid:ffb6aa41-182e-5f3e-92c1-6ad4b4c05010", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-0763 does not affect version 7.0.70-tuxcare.1 of org.apache.tomcat.extras:tomcat-extras-juli. CVE-2016-0763 affects Apache Tomcat 7.0.0-7.0.67", "justification": "code_not_present" } }, { "id": "CVE-2016-6817", "affects": [ { "ref": "pkg:maven/org.apache.tomcat.extras/tomcat-extras-juli@7.0.70-tuxcare.1" } ], "bom-ref": "urn:uuid:0fe6eb3e-8e50-58da-bb83-b85af636ffff", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-6817 does not affect version 7.0.70-tuxcare.1 of org.apache.tomcat.extras:tomcat-extras-juli. Apache Tomcat 7.0.70 is not affected by CVE-2016-6817. This CVE concerns an infinite loop vulnerability in the HTTP/2 header parser (Http2Parser.java) when processing headers larger than the available buffer. The target version 7.0.70 predates HTTP/2 support in Tomcat, which was introduced in version 8.5.0. The entire org.apache.coyote.http2 package is absent from this version. Without HTTP/2 implementation code, the target cannot receive or process HTTP/2 header data, making the vulnerability pattern impossible to manifest.", "justification": "code_not_present" } }, { "id": "CVE-2016-8747", "affects": [ { "ref": "pkg:maven/org.apache.tomcat.extras/tomcat-extras-juli@7.0.70-tuxcare.1" } ], "bom-ref": "urn:uuid:42f4ccc4-3985-52f4-8443-8f192d4cc385", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-8747 does not affect version 7.0.70-tuxcare.1 of org.apache.tomcat.extras:tomcat-extras-juli. CVE-2016-8747 affects Apache Tomcat 8.5.7-8.5.9 and 9.0.0.M11-9.0.0.M15 due to ByteBuffer state mismanagement introduced during refactoring. Tomcat 7.0.70 uses a fundamentally different architecture based on byte arrays with correct arithmetic in AbstractInputBuffer.nextRequest(), predating the vulnerable ByteBuffer refactoring. The specific vulnerable code pattern (incorrect limit calculation after ByteBuffer.compact()) does not exist in this version.", "justification": "code_not_present" } }, { "id": "CVE-2017-5650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat.extras/tomcat-extras-juli@7.0.70-tuxcare.1" } ], "bom-ref": "urn:uuid:9cb4db18-980f-5dbf-b3be-979e27f326f3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5650 does not affect version 7.0.70-tuxcare.1 of org.apache.tomcat.extras:tomcat-extras-juli. Apache Tomcat 7.0.70 is NOT AFFECTED by CVE-2017-5650. This vulnerability concerns HTTP/2 GOAWAY frame handling that could lead to thread exhaustion. Tomcat 7.0.70 does not have HTTP/2 support - the entire org.apache.coyote.http2 package and Http2UpgradeHandler class do not exist in this version. HTTP/2 support was introduced in Tomcat 8.5.0; version 7.0.70 only supports HTTP/1.1 and AJP protocols. The vulnerability's attack vector (HTTP/2 streams waiting for WINDOW_UPDATE when GOAWAY is received) relies on HTTP/2-specific flow control mechanisms that are absent from this codebase.", "justification": "code_not_present" } }, { "id": "CVE-2017-7675", "affects": [ { "ref": "pkg:maven/org.apache.tomcat.extras/tomcat-extras-juli@7.0.70-tuxcare.1" } ], "bom-ref": "urn:uuid:c0cbb095-0fba-5290-bb0e-1686a3f893af", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-7675 does not affect version 7.0.70-tuxcare.1 of org.apache.tomcat.extras:tomcat-extras-juli. CVE-2017-7675 is a security-constraint bypass in the HTTP/2 implementation of Apache Tomcat. The flaw is in org.apache.coyote.http2.Stream: while processing the ':path' pseudo-header of an incoming HTTP/2 request, the request URI was stored with MessageBytes.setString(), which keeps it as a String and so skips the byte-level URI parsing that extracts and removes path parameters. Path parameters - and the directory-traversal sequences they can carry - were therefore never processed, so the path used for security-constraint matching could diverge from the path actually served, and a specially crafted URL could evade those constraints. Apache addressed it in 8.5.16 by setting the URI as ISO-8859-1 bytes instead (svn r1796091, Bugzilla 61120), and records the issue as affecting 8.5.0 through 8.5.15 and 9.0.0.M1 through 9.0.0.M21. Apache Tomcat 7.0.x has no HTTP/2 support of any kind. The org.apache.coyote.http2 package first shipped in Tomcat 8.5.0 and was never added to the 7.0.x line. In 7.0.70, java/org/apache/coyote/ contains only the http11 and ajp protocol implementations, there is no Stream class, and no file in the source tree references HTTP/2 in any form. The only protocol handlers the release provides are Http11Protocol, Http11NioProtocol, Http11AprProtocol and AJP/1.3; Tomcat 7 has no UpgradeProtocol extension point through which an HTTP/2 implementation could be plugged in, and no bundled or declared dependency supplies one. The vulnerable code is therefore absent from this version, and the bypass it enables cannot occur.", "justification": "code_not_present" } }, { "id": "CVE-2019-2684", "affects": [ { "ref": "pkg:maven/org.apache.tomcat.extras/tomcat-extras-juli@7.0.70-tuxcare.1" } ], "bom-ref": "urn:uuid:81b27c87-5b9b-55a2-8437-eca11e351324", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-2684 affects version 7.0.70-tuxcare.1 of org.apache.tomcat.extras:tomcat-extras-juli, and is fixed in 7.0.70-tuxcare.4." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat.extras/tomcat-extras-juli@7.0.70-tuxcare.1" } ] }