{
  "@id": "urn:uuid:f014796b-e12a-45eb-a105-c1a367a6358a",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 11,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-31T14:27:20.195976+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.kafka/connect-runtime@3.2.3.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.apache.kafka/connect-runtime@3.2.3.tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T14:27:20.195976+00:00",
      "status_notes": "Vulnerability CVE-2017-12610 does not affect version 3.2.3.tuxcare of org.apache.kafka:connect-runtime. not_affected \u2014 CVE-2017-12610 affects Apache Kafka versions 0.10.0.0-0.10.2.1 and 0.11.0.0-0.11.0.1, allowing authenticated clients to impersonate other users via a crafted SASL message with a malicious authorization ID. The target version 3.2.3 is NOT affected because the upstream fix (commit 47c2753496) shipped in Kafka 1.0.0 and is present in the target. Both PlainSaslServer.java and ScramSaslServer.java v...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-12610"
      },
      "impact_statement": "not_affected \u2014 CVE-2017-12610 affects Apache Kafka versions 0.10.0.0-0.10.2.1 and 0.11.0.0-0.11.0.1, allowing authenticated clients to impersonate other users via a crafted SASL message with a malicious authorization ID. The target version 3.2.3 is NOT affected because the upstream fix (commit 47c2753496) shipped in Kafka 1.0.0 and is present in the target. Both PlainSaslServer.java and ScramSaslServer.java v..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.kafka/connect-runtime@3.2.3.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.apache.kafka/connect-runtime@3.2.3.tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-31T09:09:00.150777+00:00",
      "status_notes": "Vulnerability CVE-2021-38153 does not affect version 3.2.3.tuxcare of org.apache.kafka:connect-runtime. not_affected \u2014 CVE-2021-38153 concerns timing attacks via Arrays.equals() in password/key validation. The target is Apache Kafka 3.2.3-tuxcare.6. The CVE affects Kafka versions 2.0.0 through 2.8.0, with the fix shipped in 2.8.1+ and 3.0.0+. The target version (3.2.3) is well above the fixed versions. Analysis confirms that all affected files (PlainServerCallbackHandler.java, ScramSaslClient.java, ScramSaslSer...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-38153"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-38153 concerns timing attacks via Arrays.equals() in password/key validation. The target is Apache Kafka 3.2.3-tuxcare.6. The CVE affects Kafka versions 2.0.0 through 2.8.0, with the fix shipped in 2.8.1+ and 3.0.0+. The target version (3.2.3) is well above the fixed versions. Analysis confirms that all affected files (PlainServerCallbackHandler.java, ScramSaslClient.java, ScramSaslSer..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.kafka/connect-runtime@3.2.3.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.apache.kafka/connect-runtime@3.2.3.tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-31141 affects version 3.2.3.tuxcare of org.apache.kafka:connect-runtime, and is fixed in 3.2.3.tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2024-31141"
      },
      "action_statement": "Vulnerability CVE-2024-31141 affects version 3.2.3.tuxcare of org.apache.kafka:connect-runtime, and is fixed in 3.2.3.tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.kafka/connect-runtime@3.2.3.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.apache.kafka/connect-runtime@3.2.3.tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-27817 affects version 3.2.3.tuxcare of org.apache.kafka:connect-runtime, and is fixed in 3.2.3.tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2025-27817"
      },
      "action_statement": "Vulnerability CVE-2025-27817 affects version 3.2.3.tuxcare of org.apache.kafka:connect-runtime, and is fixed in 3.2.3.tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.kafka/connect-runtime@3.2.3.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.apache.kafka/connect-runtime@3.2.3.tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T17:02:22.125063+00:00",
      "status_notes": "Vulnerability CVE-2026-111551 affects version 3.2.3.tuxcare of org.apache.kafka:connect-runtime.",
      "vulnerability": {
        "name": "CVE-2026-111551"
      },
      "action_statement": "Vulnerability CVE-2026-111551 affects version 3.2.3.tuxcare of org.apache.kafka:connect-runtime."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.kafka/connect-runtime@3.2.3.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.apache.kafka/connect-runtime@3.2.3.tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T17:02:22.125063+00:00",
      "status_notes": "Vulnerability CVE-2026-115644 affects version 3.2.3.tuxcare of org.apache.kafka:connect-runtime.",
      "vulnerability": {
        "name": "CVE-2026-115644"
      },
      "action_statement": "Vulnerability CVE-2026-115644 affects version 3.2.3.tuxcare of org.apache.kafka:connect-runtime."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.kafka/connect-runtime@3.2.3.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.apache.kafka/connect-runtime@3.2.3.tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T17:02:22.125063+00:00",
      "status_notes": "Vulnerability CVE-2026-116593 affects version 3.2.3.tuxcare of org.apache.kafka:connect-runtime.",
      "vulnerability": {
        "name": "CVE-2026-116593"
      },
      "action_statement": "Vulnerability CVE-2026-116593 affects version 3.2.3.tuxcare of org.apache.kafka:connect-runtime."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.kafka/connect-runtime@3.2.3.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.apache.kafka/connect-runtime@3.2.3.tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-33558 affects version 3.2.3.tuxcare of org.apache.kafka:connect-runtime.",
      "vulnerability": {
        "name": "CVE-2026-33558"
      },
      "action_statement": "Vulnerability CVE-2026-33558 affects version 3.2.3.tuxcare of org.apache.kafka:connect-runtime."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.kafka/connect-runtime@3.2.3.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.apache.kafka/connect-runtime@3.2.3.tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-35554 affects version 3.2.3.tuxcare of org.apache.kafka:connect-runtime.",
      "vulnerability": {
        "name": "CVE-2026-35554"
      },
      "action_statement": "Vulnerability CVE-2026-35554 affects version 3.2.3.tuxcare of org.apache.kafka:connect-runtime."
    }
  ]
}