{
  "@id": "urn:uuid:484d35a4-f891-4ae1-b199-7b48419c0287",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 6,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T21:46:11.673949+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.jetbrains.kotlin/kotlin-reflect@1.9.24-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.jetbrains.kotlin/kotlin-reflect@1.9.24-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T21:46:11.673949+00:00",
      "status_notes": "Vulnerability CVE-2020-29582 does not affect version 1.9.24-tuxcare.1 of org.jetbrains.kotlin:kotlin-reflect. not_affected \u2014 CVE-2020-29582 affects Kotlin before 1.4.21 due to insecure temporary file/directory creation with overly permissive access rights. The target (Kotlin 1.9.24) contains an upstream fix from JetBrains (commit 090b562db7b by ilya.gorbunov@jetbrains.com, Nov 16 2020) that addresses the vulnerability by adding explicit permission restrictions to owner-only (rwx-------) immediately after temp file/di...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-29582"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-29582 affects Kotlin before 1.4.21 due to insecure temporary file/directory creation with overly permissive access rights. The target (Kotlin 1.9.24) contains an upstream fix from JetBrains (commit 090b562db7b by ilya.gorbunov@jetbrains.com, Nov 16 2020) that addresses the vulnerability by adding explicit permission restrictions to owner-only (rwx-------) immediately after temp file/di..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.jetbrains.kotlin/kotlin-reflect@1.9.24-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.jetbrains.kotlin/kotlin-reflect@1.9.24-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T21:43:44.239494+00:00",
      "status_notes": "Vulnerability CVE-2022-24329 does not affect version 1.9.24-tuxcare.1 of org.jetbrains.kotlin:kotlin-reflect. not_affected \u2014 Target version 1.9.24 is not affected by CVE-2022-24329. The vulnerability concerned the inability to lock access to the native distribution commonization cache for Kotlin multiplatform projects, allowing concurrent processes to corrupt cache data through unserialized writes. This was fixed in Kotlin 1.6.0 via upstream commit 21f7e16ee61 (KT-46343) which added file locking. The target contains ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-24329"
      },
      "impact_statement": "not_affected \u2014 Target version 1.9.24 is not affected by CVE-2022-24329. The vulnerability concerned the inability to lock access to the native distribution commonization cache for Kotlin multiplatform projects, allowing concurrent processes to corrupt cache data through unserialized writes. This was fixed in Kotlin 1.6.0 via upstream commit 21f7e16ee61 (KT-46343) which added file locking. The target contains ..."
    }
  ]
}