{ "@id": "urn:uuid:86025173-67fc-43c2-9b08-889f22e4f486", "role": "Document Creator", "author": "https://tuxcare.com", "version": 1, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-15T06:18:14.403612+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.activemq.examples.failover/multiple-failover-failback@2.19.1-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.activemq.examples.failover/multiple-failover-failback@2.19.1-tuxcare.1" } } ], "timestamp": "2026-11-15T06:18:14.403612+00:00", "status_notes": "Vulnerability CVE-2011-4905 does not affect version 2.19.1-tuxcare.1 of org.apache.activemq.examples.failover:multiple-failover-failback. not_affected \u2014 Target is Apache ActiveMQ Artemis 2.19.1. TuxCare maps CVE-2011-4905 (OpenWire/failover:tcp:// file-descriptor-exhaustion DoS) to the Artemis fix ARTEMIS-1727 (commit 29250466 \"Make sure transport is stopped on failed OpenWire connection\"), which touches artemis-openwire-protocol/.../OpenWireConnection.java. [VC re-run with claude-opus-4-8, prod prompt f71480c, 2026-09-11; applied manually after git verification]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2011-4905" }, "impact_statement": "not_affected \u2014 Target is Apache ActiveMQ Artemis 2.19.1. TuxCare maps CVE-2011-4905 (OpenWire/failover:tcp:// file-descriptor-exhaustion DoS) to the Artemis fix ARTEMIS-1727 (commit 29250466 \"Make sure transport is stopped on failed OpenWire connection\"), which touches artemis-openwire-protocol/.../OpenWireConnection.java. [VC re-run with claude-opus-4-8, prod prompt f71480c, 2026-09-11; applied manually after git verification]" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.activemq.examples.failover/multiple-failover-failback@2.19.1-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.activemq.examples.failover/multiple-failover-failback@2.19.1-tuxcare.1" } } ], "timestamp": "2026-11-15T06:18:14.403612+00:00", "status_notes": "Vulnerability CVE-2018-8909 is a false positive for org.apache.activemq.examples.failover:multiple-failover-failback 2.19.1-tuxcare.1. CVE-2018-8909 concerns the Wire Android messaging application and references AssetService.scala. The target repository is Apache ActiveMQ Artemis version 2.19.1, a Java-based message broker with completely different functionality, architecture, and codebase. No Wire application code, Scala files, AssetService references, or any Wire-related components exist in this repository. This is a wrong-project match.", "vulnerability": { "name": "CVE-2018-8909" }, "impact_statement": "CVE-2018-8909 concerns the Wire Android messaging application and references AssetService.scala. The target repository is Apache ActiveMQ Artemis version 2.19.1, a Java-based message broker with completely different functionality, architecture, and codebase. No Wire application code, Scala files, AssetService references, or any Wire-related components exist in this repository. This is a wrong-project match." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.activemq.examples.failover/multiple-failover-failback@2.19.1-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.activemq.examples.failover/multiple-failover-failback@2.19.1-tuxcare.1" } } ], "timestamp": "2026-11-15T06:18:14.403612+00:00", "status_notes": "Vulnerability CVE-2020-15258 is a false positive for org.apache.activemq.examples.failover:multiple-failover-failback 2.19.1-tuxcare.1. CVE-2020-15258 is a wrong-project match. This CVE affects Wire (an Electron-based messaging application using Node.js APIs like shell.openExternal), but the target repository is Apache ActiveMQ Artemis version 2.19.1 (a Java-based message broker). The affected component (Wire's Electron code) is completely absent from this repository - no identity match, no vendored copy, and no dependency relationship.", "vulnerability": { "name": "CVE-2020-15258" }, "impact_statement": "CVE-2020-15258 is a wrong-project match. This CVE affects Wire (an Electron-based messaging application using Node.js APIs like shell.openExternal), but the target repository is Apache ActiveMQ Artemis version 2.19.1 (a Java-based message broker). The affected component (Wire's Electron code) is completely absent from this repository - no identity match, no vendored copy, and no dependency relationship." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.activemq.examples.failover/multiple-failover-failback@2.19.1-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.activemq.examples.failover/multiple-failover-failback@2.19.1-tuxcare.1" } } ], "timestamp": "2026-11-15T06:18:14.403612+00:00", "status_notes": "Vulnerability CVE-2020-27853 is a false positive for org.apache.activemq.examples.failover:multiple-failover-failback 2.19.1-tuxcare.1. CVE-2020-27853 is a wrong-project match. This CVE affects Wire AVS (Audio, Video, and Signaling), a C library used in Wire Secure Messenger for real-time communications. The target repository is Apache ActiveMQ Artemis 2.19.1, a Java-based message broker with no relationship to Wire. The vulnerable function (sdp_media_set_lattr in peerflow/sdp.c) does not exist, Wire AVS is not vendored or bundled, and no dependencies reference it. All \"wire\" references found are to ActiveMQ's \"OpenWire\" protocol, which is an unrelated messaging protocol.", "vulnerability": { "name": "CVE-2020-27853" }, "impact_statement": "CVE-2020-27853 is a wrong-project match. This CVE affects Wire AVS (Audio, Video, and Signaling), a C library used in Wire Secure Messenger for real-time communications. The target repository is Apache ActiveMQ Artemis 2.19.1, a Java-based message broker with no relationship to Wire. The vulnerable function (sdp_media_set_lattr in peerflow/sdp.c) does not exist, Wire AVS is not vendored or bundled, and no dependencies reference it. All \"wire\" references found are to ActiveMQ's \"OpenWire\" protocol, which is an unrelated messaging protocol." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.activemq.examples.failover/multiple-failover-failback@2.19.1-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.activemq.examples.failover/multiple-failover-failback@2.19.1-tuxcare.1" } } ], "timestamp": "2026-11-15T06:18:14.403612+00:00", "status_notes": "Vulnerability CVE-2021-21301 is a false positive for org.apache.activemq.examples.failover:multiple-failover-failback 2.19.1-tuxcare.1. false_positive \u2014 CVE-2021-21301 is a false positive match. The advisory concerns Wire for iOS, an iOS video calling application with a vulnerability where video capture continues after the user disables their camera. The target repository is Apache ActiveMQ Artemis version 2.19.1, a Java-based message broker with no video calling functionality, no iOS code, and no relationship to the Wire collaboration platform...", "vulnerability": { "name": "CVE-2021-21301" }, "impact_statement": "false_positive \u2014 CVE-2021-21301 is a false positive match. The advisory concerns Wire for iOS, an iOS video calling application with a vulnerability where video capture continues after the user disables their camera. The target repository is Apache ActiveMQ Artemis version 2.19.1, a Java-based message broker with no video calling functionality, no iOS code, and no relationship to the Wire collaboration platform..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.activemq.examples.failover/multiple-failover-failback@2.19.1-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.activemq.examples.failover/multiple-failover-failback@2.19.1-tuxcare.1" } } ], "timestamp": "2026-11-15T06:18:14.403612+00:00", "status_notes": "Vulnerability CVE-2021-32665 is a false positive for org.apache.activemq.examples.failover:multiple-failover-failback 2.19.1-tuxcare.1. CVE-2021-32665 is a false positive for this repository. The CVE concerns wire-ios (an iOS secure messaging app), but the target repository is Apache ActiveMQ Artemis version 2.19.1 (a Java message broker). These are completely different products from different vendors, serving different purposes, in different programming languages. No trace of wire-ios code, dependencies, or references exists in this repository.", "vulnerability": { "name": "CVE-2021-32665" }, "impact_statement": "CVE-2021-32665 is a false positive for this repository. The CVE concerns wire-ios (an iOS secure messaging app), but the target repository is Apache ActiveMQ Artemis version 2.19.1 (a Java message broker). These are completely different products from different vendors, serving different purposes, in different programming languages. No trace of wire-ios code, dependencies, or references exists in this repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.activemq.examples.failover/multiple-failover-failback@2.19.1-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.activemq.examples.failover/multiple-failover-failback@2.19.1-tuxcare.1" } } ], "timestamp": "2026-11-15T06:18:14.403612+00:00", "status_notes": "Vulnerability CVE-2021-32666 is a false positive for org.apache.activemq.examples.failover:multiple-failover-failback 2.19.1-tuxcare.1. false_positive \u2014 Wrong-project match. CVE-2021-32666 concerns wire-ios (iOS secure messaging app with profile picture assetID crash vulnerability), but the target repository is Apache ActiveMQ Artemis version 2.19.1 (Java-based message broker). These are completely different products with no code relationship.", "vulnerability": { "name": "CVE-2021-32666" }, "impact_statement": "false_positive \u2014 Wrong-project match. CVE-2021-32666 concerns wire-ios (iOS secure messaging app with profile picture assetID crash vulnerability), but the target repository is Apache ActiveMQ Artemis version 2.19.1 (Java-based message broker). These are completely different products with no code relationship." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.activemq.examples.failover/multiple-failover-failback@2.19.1-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.activemq.examples.failover/multiple-failover-failback@2.19.1-tuxcare.1" } } ], "timestamp": "2026-11-15T06:18:14.403612+00:00", "status_notes": "Vulnerability CVE-2021-32755 is a false positive for org.apache.activemq.examples.failover:multiple-failover-failback 2.19.1-tuxcare.1. false_positive \u2014 CVE-2021-32755 concerns Wire collaboration platform's iOS transport library (wire-ios-transport) missing certificate pinning on websockets in iOS versions 3.82-3.84. This repository is Apache ActiveMQ Artemis 2.19.1, a Java-based message broker with no relationship to the Wire product. Product-Identity Check confirms: (a) target is Apache Artemis, not Wire; (b) CVE concerns wire-ios-transport i...", "vulnerability": { "name": "CVE-2021-32755" }, "impact_statement": "false_positive \u2014 CVE-2021-32755 concerns Wire collaboration platform's iOS transport library (wire-ios-transport) missing certificate pinning on websockets in iOS versions 3.82-3.84. This repository is Apache ActiveMQ Artemis 2.19.1, a Java-based message broker with no relationship to the Wire product. Product-Identity Check confirms: (a) target is Apache Artemis, not Wire; (b) CVE concerns wire-ios-transport i..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.activemq.examples.failover/multiple-failover-failback@2.19.1-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.activemq.examples.failover/multiple-failover-failback@2.19.1-tuxcare.1" } } ], "timestamp": "2026-11-15T06:18:14.403612+00:00", "status_notes": "Vulnerability CVE-2021-41093 is a false positive for org.apache.activemq.examples.failover:multiple-failover-failback 2.19.1-tuxcare.1. CVE-2021-41093 is a false positive for this repository. The CVE describes a vulnerability in Wire (an open-source secure messenger application) where an attacker with an old but valid access token can take over an account by changing the email. The target repository is Apache ActiveMQ Artemis 2.19.1, a message broker system. These are completely different products: Wire is a messaging client application, while ActiveMQ Artemis is a message broker for JMS/AMQP/MQTT protocols. No Wire code, dependencies, or related functionality exists in this repository.", "vulnerability": { "name": "CVE-2021-41093" }, "impact_statement": "CVE-2021-41093 is a false positive for this repository. The CVE describes a vulnerability in Wire (an open-source secure messenger application) where an attacker with an old but valid access token can take over an account by changing the email. The target repository is Apache ActiveMQ Artemis 2.19.1, a message broker system. These are completely different products: Wire is a messaging client application, while ActiveMQ Artemis is a message broker for JMS/AMQP/MQTT protocols. No Wire code, dependencies, or related functionality exists in this repository." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.activemq.examples.failover/multiple-failover-failback@2.19.1-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.activemq.examples.failover/multiple-failover-failback@2.19.1-tuxcare.1" } } ], "timestamp": "2026-11-15T06:18:14.403612+00:00", "status_notes": "Vulnerability CVE-2022-23625 is a false positive for org.apache.activemq.examples.failover:multiple-failover-failback 2.19.1-tuxcare.1. false_positive \u2014 CVE-2022-23625 is a wrong-project match. The CVE concerns Wire-ios (an iOS messaging application written in Swift), but the target repository is Apache ActiveMQ Artemis 2.19.1 (a Java-based messaging broker). The affected component (wireapp/wire-ios-transport) and its code are completely absent from the Artemis repository. No Swift files, iOS project files, or Wire-related dependencies exist in...", "vulnerability": { "name": "CVE-2022-23625" }, "impact_statement": "false_positive \u2014 CVE-2022-23625 is a wrong-project match. The CVE concerns Wire-ios (an iOS messaging application written in Swift), but the target repository is Apache ActiveMQ Artemis 2.19.1 (a Java-based messaging broker). The affected component (wireapp/wire-ios-transport) and its code are completely absent from the Artemis repository. No Swift files, iOS project files, or Wire-related dependencies exist in..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.activemq.examples.failover/multiple-failover-failback@2.19.1-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.activemq.examples.failover/multiple-failover-failback@2.19.1-tuxcare.1" } } ], "timestamp": "2026-11-15T06:18:14.403612+00:00", "status_notes": "Vulnerability CVE-2022-31009 is a false positive for org.apache.activemq.examples.failover:multiple-failover-failback 2.19.1-tuxcare.1. false_positive \u2014 CVE-2022-31009 is a wrong-project match. The CVE describes a vulnerability in wire-ios (an iOS messaging client for the Wire secure messaging app) where invalid accent color integer values crash the app via assertion failure. The target repository is Apache ActiveMQ Artemis 2.19.1, a Java-based message broker that has no relationship to wire-ios. The string \"wire\" appears in the target only as ...", "vulnerability": { "name": "CVE-2022-31009" }, "impact_statement": "false_positive \u2014 CVE-2022-31009 is a wrong-project match. The CVE describes a vulnerability in wire-ios (an iOS messaging client for the Wire secure messaging app) where invalid accent color integer values crash the app via assertion failure. The target repository is Apache ActiveMQ Artemis 2.19.1, a Java-based message broker that has no relationship to wire-ios. The string \"wire\" appears in the target only as ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.activemq.examples.failover/multiple-failover-failback@2.19.1-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.activemq.examples.failover/multiple-failover-failback@2.19.1-tuxcare.1" } } ], "timestamp": "2026-11-15T06:18:14.403612+00:00", "status_notes": "Vulnerability CVE-2022-43673 is a false positive for org.apache.activemq.examples.failover:multiple-failover-failback 2.19.1-tuxcare.1. false_positive \u2014 CVE-2022-43673 is a false positive for Apache ActiveMQ Artemis. The CVE concerns Wire (a messaging client application for Windows) and its client-side IndexedDB storage issue where deleted messages remain retrievable. Apache ActiveMQ Artemis is a completely different product - a Java-based server-side message broker. No Wire code, dependencies, or related functionality exists in this repository...", "vulnerability": { "name": "CVE-2022-43673" }, "impact_statement": "false_positive \u2014 CVE-2022-43673 is a false positive for Apache ActiveMQ Artemis. The CVE concerns Wire (a messaging client application for Windows) and its client-side IndexedDB storage issue where deleted messages remain retrievable. Apache ActiveMQ Artemis is a completely different product - a Java-based server-side message broker. No Wire code, dependencies, or related functionality exists in this repository..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.apache.activemq.examples.failover/multiple-failover-failback@2.19.1-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.apache.activemq.examples.failover/multiple-failover-failback@2.19.1-tuxcare.1" } } ], "timestamp": "2026-11-15T06:18:14.403612+00:00", "status_notes": "Vulnerability CVE-2023-22737 is a false positive for org.apache.activemq.examples.failover:multiple-failover-failback 2.19.1-tuxcare.1. false_positive \u2014 CVE-2023-22737 is a false positive for this repository. The CVE concerns wire-server (backend for Wire team communication platform), but the target repository is Apache ActiveMQ Artemis 2.19.1 (a messaging broker). These are completely different products with no relationship. The CVE's vulnerability about unauthorized Bot removal from Conversations is specific to Wire's team communication featu...", "vulnerability": { "name": "CVE-2023-22737" }, "impact_statement": "false_positive \u2014 CVE-2023-22737 is a false positive for this repository. The CVE concerns wire-server (backend for Wire team communication platform), but the target repository is Apache ActiveMQ Artemis 2.19.1 (a messaging broker). These are completely different products with no relationship. The CVE's vulnerability about unauthorized Bot removal from Conversations is specific to Wire's team communication featu..." } ] }