{
  "@id": "urn:uuid:8e4cc2b0-c30c-4d75-bc5d-0dfe9d48e21f",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 23,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T14:22:27.284985+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-jasper@7.0.70-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-jasper@7.0.70-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2012-5568 affects version 7.0.70-tuxcare.3 of org.apache.tomcat:tomcat-jasper and will not be fixed. Apache does not treat CVE-2012-5568 as a Tomcat vulnerability and ships no fix; mitigation is connector configuration.",
      "vulnerability": {
        "name": "CVE-2012-5568"
      },
      "action_statement": "Vulnerability CVE-2012-5568 affects version 7.0.70-tuxcare.3 of org.apache.tomcat:tomcat-jasper and will not be fixed. Apache does not treat CVE-2012-5568 as a Tomcat vulnerability and ships no fix; mitigation is connector configuration."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-jasper@7.0.70-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-jasper@7.0.70-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2016-5018 is fixed in version 7.0.70-tuxcare.3 of org.apache.tomcat:tomcat-jasper.",
      "vulnerability": {
        "name": "CVE-2016-5018"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-jasper@7.0.70-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-jasper@7.0.70-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2016-8745 is fixed in version 7.0.70-tuxcare.3 of org.apache.tomcat:tomcat-jasper.",
      "vulnerability": {
        "name": "CVE-2016-8745"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-jasper@7.0.70-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-jasper@7.0.70-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2019-2684 affects version 7.0.70-tuxcare.3 of org.apache.tomcat:tomcat-jasper, and is fixed in 7.0.70-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2019-2684"
      },
      "action_statement": "Vulnerability CVE-2019-2684 affects version 7.0.70-tuxcare.3 of org.apache.tomcat:tomcat-jasper, and is fixed in 7.0.70-tuxcare.4."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-jasper@7.0.70-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-jasper@7.0.70-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-45143 does not affect version 7.0.70-tuxcare.3 of org.apache.tomcat:tomcat-jasper. Tomcat 7.0.70 is not affected by CVE-2022-45143. The vulnerable component JsonErrorReportValve does not exist in this version - it was introduced 4+ years later in Tomcat 9.0.40 (October 2020). Tomcat 7.0.70 only has ErrorReportValve, which outputs HTML error pages, not JSON. The attack chain requires JSON output to reach the Goal (manipulated JSON), but no JSON error reporting capability exists in this version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-45143"
      },
      "impact_statement": "Tomcat 7.0.70 is not affected by CVE-2022-45143. The vulnerable component JsonErrorReportValve does not exist in this version - it was introduced 4+ years later in Tomcat 9.0.40 (October 2020). Tomcat 7.0.70 only has ErrorReportValve, which outputs HTML error pages, not JSON. The attack chain requires JSON output to reach the Goal (manipulated JSON), but no JSON error reporting capability exists in this version."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-jasper@7.0.70-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-jasper@7.0.70-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-42795 affects version 7.0.70-tuxcare.3 of org.apache.tomcat:tomcat-jasper.",
      "vulnerability": {
        "name": "CVE-2023-42795"
      },
      "action_statement": "Vulnerability CVE-2023-42795 affects version 7.0.70-tuxcare.3 of org.apache.tomcat:tomcat-jasper."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-jasper@7.0.70-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-jasper@7.0.70-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T21:58:36.804623+00:00",
      "status_notes": "Vulnerability CVE-2026-53434 affects version 7.0.70-tuxcare.3 of org.apache.tomcat:tomcat-jasper.",
      "vulnerability": {
        "name": "CVE-2026-53434"
      },
      "action_statement": "Vulnerability CVE-2026-53434 affects version 7.0.70-tuxcare.3 of org.apache.tomcat:tomcat-jasper."
    }
  ]
}