{
  "@id": "urn:uuid:8178ae62-0c07-413c-a709-59e45b10baf6",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 12,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-31T14:28:41.839424+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.kafka/connect-transforms@3.2.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.kafka/connect-transforms@3.2.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T14:28:41.839424+00:00",
      "status_notes": "Vulnerability CVE-2017-12610 does not affect version 3.2.2-tuxcare.1 of org.apache.kafka:connect-transforms. not_affected \u2014 CVE-2017-12610 does not affect Kafka 3.2.2. The vulnerability (SASL authorization ID impersonation) was fixed by upstream Apache Kafka in August 2017 (commit 47c2753), included in Kafka 1.0.0 and all subsequent releases. The target version 3.2.2 already contains the fix that validates the client-provided authorization ID must match the authenticated username, preventing impersonation attacks.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-12610"
      },
      "impact_statement": "not_affected \u2014 CVE-2017-12610 does not affect Kafka 3.2.2. The vulnerability (SASL authorization ID impersonation) was fixed by upstream Apache Kafka in August 2017 (commit 47c2753), included in Kafka 1.0.0 and all subsequent releases. The target version 3.2.2 already contains the fix that validates the client-provided authorization ID must match the authenticated username, preventing impersonation attacks."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.kafka/connect-transforms@3.2.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.kafka/connect-transforms@3.2.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T09:10:00.186757+00:00",
      "status_notes": "Vulnerability CVE-2021-38153 does not affect version 3.2.2-tuxcare.1 of org.apache.kafka:connect-transforms. not_affected \u2014 CVE-2021-38153 (timing attack vulnerability via Arrays.equals) is NOT present in the target. The fix was already included in the upstream Apache Kafka 3.2.2 release that TuxCare onboarded. All affected authentication/validation code uses constant-time comparison algorithms: Utils.isEqualConstantTime() for char arrays and MessageDigest.isEqual() for byte arrays.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-38153"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-38153 (timing attack vulnerability via Arrays.equals) is NOT present in the target. The fix was already included in the upstream Apache Kafka 3.2.2 release that TuxCare onboarded. All affected authentication/validation code uses constant-time comparison algorithms: Utils.isEqualConstantTime() for char arrays and MessageDigest.isEqual() for byte arrays."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.kafka/connect-transforms@3.2.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.kafka/connect-transforms@3.2.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-34917 does not affect version 3.2.2-tuxcare.1 of org.apache.kafka:connect-transforms. already_fixed \u2014 The target repository (Apache Kafka version 3.2.2) already contains the fix for CVE-2022-34917. The upstream fix commit 2bfa24b2bd416e7b8c4a0c566b984c43904fdecb 'MINOR: Add more validation during KRPC deserialization' is present in the git ancestry of the target SHA 38c22ad893fb6cf52b0e139e8db62320f8580ac2. All defense validations that prevent malicious memory allocation during KRPC deserializa...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-34917"
      },
      "impact_statement": "already_fixed \u2014 The target repository (Apache Kafka version 3.2.2) already contains the fix for CVE-2022-34917. The upstream fix commit 2bfa24b2bd416e7b8c4a0c566b984c43904fdecb 'MINOR: Add more validation during KRPC deserialization' is present in the git ancestry of the target SHA 38c22ad893fb6cf52b0e139e8db62320f8580ac2. All defense validations that prevent malicious memory allocation during KRPC deserializa..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.kafka/connect-transforms@3.2.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.kafka/connect-transforms@3.2.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-31141 affects version 3.2.2-tuxcare.1 of org.apache.kafka:connect-transforms.",
      "vulnerability": {
        "name": "CVE-2024-31141"
      },
      "action_statement": "Vulnerability CVE-2024-31141 affects version 3.2.2-tuxcare.1 of org.apache.kafka:connect-transforms."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.kafka/connect-transforms@3.2.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.kafka/connect-transforms@3.2.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-27817 is fixed in version 3.2.2-tuxcare.1 of org.apache.kafka:connect-transforms.",
      "vulnerability": {
        "name": "CVE-2025-27817"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.kafka/connect-transforms@3.2.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.kafka/connect-transforms@3.2.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T17:02:22.125063+00:00",
      "status_notes": "Vulnerability CVE-2026-111551 affects version 3.2.2-tuxcare.1 of org.apache.kafka:connect-transforms.",
      "vulnerability": {
        "name": "CVE-2026-111551"
      },
      "action_statement": "Vulnerability CVE-2026-111551 affects version 3.2.2-tuxcare.1 of org.apache.kafka:connect-transforms."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.kafka/connect-transforms@3.2.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.kafka/connect-transforms@3.2.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-33558 affects version 3.2.2-tuxcare.1 of org.apache.kafka:connect-transforms.",
      "vulnerability": {
        "name": "CVE-2026-33558"
      },
      "action_statement": "Vulnerability CVE-2026-33558 affects version 3.2.2-tuxcare.1 of org.apache.kafka:connect-transforms."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.kafka/connect-transforms@3.2.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.kafka/connect-transforms@3.2.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-35554 affects version 3.2.2-tuxcare.1 of org.apache.kafka:connect-transforms.",
      "vulnerability": {
        "name": "CVE-2026-35554"
      },
      "action_statement": "Vulnerability CVE-2026-35554 affects version 3.2.2-tuxcare.1 of org.apache.kafka:connect-transforms."
    }
  ]
}