Skip to content

Commit 3111155

Browse files
ppkarwaszppkarwasz
authored
feat: Add experimental CycloneDX VEX file (#446)
* feat: Add experimental CycloneDX VEX file This commit introduces an experimental CycloneDX VEX document that: * Provides an analysis of CVE-2025-48924 as it pertains to this library. * Is committed to the **Git repository only** (not published to the website), allowing it to be retrieved via `raw.githubusercontent.com`. This VEX file is intended to support consumers in evaluating the exploitability of known vulnerabilities in Apache Commons BCEL. * fix: Address review suggestions * fix: Link in readme file
1 parent ff2b62e commit 3111155

2 files changed

Lines changed: 177 additions & 0 deletions

File tree

‎src/conf/security/README.md‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
<!--
2+
~ Licensed to the Apache Software Foundation (ASF) under one or more
3+
~ contributor license agreements. See the NOTICE file distributed with
4+
~ this work for additional information regarding copyright ownership.
5+
~ The ASF licenses this file to you under the Apache License, Version 2.0
6+
~ (the "License"); you may not use this file except in compliance with
7+
~ the License. You may obtain a copy of the License at
8+
~
9+
~ http://www.apache.org/licenses/LICENSE-2.0
10+
~
11+
~ Unless required by applicable law or agreed to in writing, software
12+
~ distributed under the License is distributed on an "AS IS" BASIS,
13+
~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
~ See the License for the specific language governing permissions and
15+
~ limitations under the License.
16+
-->
17+
18+
# CycloneDX Documents for Apache Commons BCEL
19+
20+
The Apache Commons BCEL project publishes multiple [CycloneDX](https://cyclonedx.org/) documents to help consumers assess the security of their applications using this library:
21+
22+
## SBOM (Software Bill of Materials)
23+
24+
Beginning with version `6.6.0`, Apache Commons BCEL publishes SBOMs in both **XML** and **JSON** formats to Maven Central. These documents describe all components and dependencies of the library, following standard Maven coordinates:
25+
26+
* **Group ID:** `org.apache.bcel`
27+
* **Artifact ID:** `bcel`
28+
* **Classifier:** `cyclonedx`
29+
* **Type:** `xml` or `json`
30+
31+
Each SBOM lists the library’s required and optional dependencies, helping consumers analyze the software supply chain and manage dependency risk.
32+
33+
> [!NOTE]
34+
> The versions listed in the SBOM reflect the dependencies used during the build and test process for that specific release of BCEL.
35+
> Your own project may use different versions depending on your dependency management configuration.
36+
37+
## VEX (Vulnerability Exploitability eXchange)
38+
39+
An experimental [VEX](https://cyclonedx.org/capabilities/vex/) document is also published:
40+
41+
👉 [`https://raw.githubusercontent.com/apache/commons-bcel/refs/heads/master/src/conf/security/VEX.cyclonedx.xml`](VEX.cyclonedx.xml)
42+
43+
This document provides information about the **exploitability of known vulnerabilities** in the **dependencies** of Apache Commons BCEL.
44+
45+
### When is a dependency vulnerability exploitable?
46+
47+
Because Apache Commons libraries (including BCEL) do **not** bundle their dependencies, a vulnerability in a dependency is only exploitable if **both** of the following conditions are true:
48+
49+
1. The vulnerable dependency is included in the consuming project.
50+
2. Apache Commons BCEL is explicitly listed as affected by the vulnerability.
51+
52+
### Notes and Limitations
53+
54+
* This VEX document is **experimental** and provided **as-is**.
55+
The semantics of this document may change in the future.
56+
* The **absence** of a vulnerability entry does **not** indicate that BCEL is unaffected.
57+
* If a version of BCEL is not listed under the `affects` section of a vulnerability, that version may still be affected or not.
58+
* Only the **latest major version** of BCEL is currently assessed for vulnerabilities.
59+
* The `analysis` field in the VEX file uses **Markdown** formatting.
60+
61+
For more information about CycloneDX, SBOMs, or VEX, visit [cyclonedx.org](https://cyclonedx.org/).

‎src/conf/security/VEX.cyclonedx.xml‎

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
~ Licensed to the Apache Software Foundation (ASF) under one or more
4+
~ contributor license agreements. See the NOTICE file distributed with
5+
~ this work for additional information regarding copyright ownership.
6+
~ The ASF licenses this file to you under the Apache License, Version 2.0
7+
~ (the "License"); you may not use this file except in compliance with
8+
~ the License. You may obtain a copy of the License at
9+
~
10+
~ http://www.apache.org/licenses/LICENSE-2.0
11+
~
12+
~ Unless required by applicable law or agreed to in writing, software
13+
~ distributed under the License is distributed on an "AS IS" BASIS,
14+
~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
~ See the License for the specific language governing permissions and
16+
~ limitations under the License.
17+
-->
18+
<!--
19+
To update this document:
20+
1. Increment the `version` attribute in the <bom> element.
21+
2. Update the `timestamp` in the <metadata> section.
22+
-->
23+
<bom xmlns="http://cyclonedx.org/schema/bom/1.6"
24+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
25+
xsi:schemaLocation="http://cyclonedx.org/schema/bom/1.6 https://cyclonedx.org/schema/bom-1.6.xsd"
26+
serialNumber="urn:uuid:f70dec29-fc7d-41f2-8c60-97e9075e0e73"
27+
version="1">
28+
29+
<metadata>
30+
<timestamp>2025-07-29T12:26:42Z</timestamp>
31+
<component type="library" bom-ref="main_component">
32+
<group>org.apache.bcel</group>
33+
<name>bcel</name>
34+
<cpe>cpe:2.3:a:apache:commons_bcel:*:*:*:*:*:*:*:*</cpe>
35+
<purl>pkg:maven/org.apache.bcel/bcel?type=jar</purl>
36+
</component>
37+
<manufacturer>
38+
<name>The Apache Software Foundation</name>
39+
<url>https://commons.apache.org</url>
40+
<contact>
41+
<name>Apache Commons PMC</name>
42+
<email>dev@commons.apache.org</email>
43+
</contact>
44+
<contact>
45+
<name>Apache Commons Security Team</name>
46+
<email>security@commons.apache.org</email>
47+
</contact>
48+
</manufacturer>
49+
</metadata>
50+
51+
<vulnerabilities>
52+
<vulnerability>
53+
<id>CVE-2025-48924</id>
54+
<references>
55+
<reference>
56+
<id>GHSA-j288-q9x7-2f5v</id>
57+
<source>
58+
<url>https://github.com/advisories/GHSA-j288-q9x7-2f5v</url>
59+
</source>
60+
</reference>
61+
</references>
62+
<analysis>
63+
<state>not_affected</state>
64+
<justification>code_not_reachable</justification>
65+
<detail>
66+
Apache Commons BCEL is *not* affected by CVE-2025-48924 because the vulnerable method `ClassUtils.getClass()`
67+
is not used in the Apache Commons BCEL codebase nor any of its runtime dependencies.
68+
</detail>
69+
<firstIssued>2025-07-29T12:26:42Z</firstIssued>
70+
<lastUpdated>2025-07-29T12:26:42Z</lastUpdated>
71+
</analysis>
72+
<affects>
73+
<target>
74+
<ref>main_component</ref>
75+
<versions>
76+
<version>
77+
<range><![CDATA[vers:maven/>=6.0|<7]]></range>
78+
<status>unaffected</status>
79+
</version>
80+
</versions>
81+
</target>
82+
</affects>
83+
</vulnerability>
84+
</vulnerabilities>
85+
86+
<annotations>
87+
<annotation>
88+
<annotator>
89+
<individual>
90+
<name>Apache Commons PMC</name>
91+
<email>dev@commons.apache.org</email>
92+
</individual>
93+
</annotator>
94+
<timestamp>2025-07-29T12:26:42Z</timestamp>
95+
<text>
96+
This document provides information about the **exploitability of known vulnerabilities** in the **dependencies** of Apache Commons BCEL.
97+
98+
# When is a dependency vulnerability exploitable?
99+
100+
Because Apache Commons libraries do **not** bundle their dependencies, a vulnerability in a dependency is only exploitable if **both** of the following conditions are true:
101+
102+
1. The vulnerable dependency is included in the consuming project.
103+
2. Apache Commons BCEL is explicitly listed as affected by the vulnerability.
104+
105+
# Notes and Limitations
106+
107+
* This VEX document is **experimental** and provided **as-is**.
108+
The semantics of this document may change in the future.
109+
* The **absence** of a vulnerability entry does **not** indicate that BCEL is unaffected.
110+
* If a version of BCEL is not listed under the `affects` section of a vulnerability, that version may still be affected or not.
111+
* Only the **latest major version** of BCEL is currently assessed for vulnerabilities.
112+
* The `analysis` field in the VEX file uses **Markdown** formatting.
113+
</text>
114+
</annotation>
115+
</annotations>
116+
</bom>

0 commit comments

Comments
 (0)