diff --git a/src/conf/security/README.md b/src/conf/security/README.md new file mode 100644 index 0000000000..847f4ccc81 --- /dev/null +++ b/src/conf/security/README.md @@ -0,0 +1,61 @@ + + +# CycloneDX Documents for Apache Commons BCEL + +The Apache Commons BCEL project publishes multiple [CycloneDX](https://cyclonedx.org/) documents to help consumers assess the security of their applications using this library: + +## SBOM (Software Bill of Materials) + +Beginning with version `6.6.0`, Apache Commons BCEL publishes SBOMs in both **XML** and **JSON** formats to Maven Central. These documents describe all components and dependencies of the library, following standard Maven coordinates: + +* **Group ID:** `org.apache.bcel` +* **Artifact ID:** `bcel` +* **Classifier:** `cyclonedx` +* **Type:** `xml` or `json` + +Each SBOM lists the library’s required and optional dependencies, helping consumers analyze the software supply chain and manage dependency risk. + +> [!NOTE] +> The versions listed in the SBOM reflect the dependencies used during the build and test process for that specific release of BCEL. +> Your own project may use different versions depending on your dependency management configuration. + +## VEX (Vulnerability Exploitability eXchange) + +An experimental [VEX](https://cyclonedx.org/capabilities/vex/) document is also published: + +👉 [`https://raw.githubusercontent.com/apache/commons-bcel/refs/heads/master/src/conf/security/VEX.cyclonedx.xml`](VEX.cyclonedx.xml) + +This document provides information about the **exploitability of known vulnerabilities** in the **dependencies** of Apache Commons BCEL. + +### When is a dependency vulnerability exploitable? + +Because Apache Commons libraries (including BCEL) do **not** bundle their dependencies, a vulnerability in a dependency is only exploitable if **both** of the following conditions are true: + +1. The vulnerable dependency is included in the consuming project. +2. Apache Commons BCEL is explicitly listed as affected by the vulnerability. + +### Notes and Limitations + +* This VEX document is **experimental** and provided **as-is**. + The semantics of this document may change in the future. +* The **absence** of a vulnerability entry does **not** indicate that BCEL is unaffected. +* If a version of BCEL is not listed under the `affects` section of a vulnerability, that version may still be affected or not. +* Only the **latest major version** of BCEL is currently assessed for vulnerabilities. +* The `analysis` field in the VEX file uses **Markdown** formatting. + +For more information about CycloneDX, SBOMs, or VEX, visit [cyclonedx.org](https://cyclonedx.org/). diff --git a/src/conf/security/VEX.cyclonedx.xml b/src/conf/security/VEX.cyclonedx.xml new file mode 100644 index 0000000000..06b67bb30c --- /dev/null +++ b/src/conf/security/VEX.cyclonedx.xml @@ -0,0 +1,116 @@ + + + + + + + 2025-07-29T12:26:42Z + + org.apache.bcel + bcel + cpe:2.3:a:apache:commons_bcel:*:*:*:*:*:*:*:* + pkg:maven/org.apache.bcel/bcel?type=jar + + + The Apache Software Foundation + https://commons.apache.org + + Apache Commons PMC + dev@commons.apache.org + + + Apache Commons Security Team + security@commons.apache.org + + + + + + + CVE-2025-48924 + + + GHSA-j288-q9x7-2f5v + + https://github.com/advisories/GHSA-j288-q9x7-2f5v + + + + + not_affected + code_not_reachable + + Apache Commons BCEL is *not* affected by CVE-2025-48924 because the vulnerable method `ClassUtils.getClass()` + is not used in the Apache Commons BCEL codebase nor any of its runtime dependencies. + + 2025-07-29T12:26:42Z + 2025-07-29T12:26:42Z + + + + main_component + + + =6.0|<7]]> + unaffected + + + + + + + + + + + + Apache Commons PMC + dev@commons.apache.org + + + 2025-07-29T12:26:42Z + + This document provides information about the **exploitability of known vulnerabilities** in the **dependencies** of Apache Commons BCEL. + + # When is a dependency vulnerability exploitable? + + Because Apache Commons libraries do **not** bundle their dependencies, a vulnerability in a dependency is only exploitable if **both** of the following conditions are true: + + 1. The vulnerable dependency is included in the consuming project. + 2. Apache Commons BCEL is explicitly listed as affected by the vulnerability. + + # Notes and Limitations + + * This VEX document is **experimental** and provided **as-is**. + The semantics of this document may change in the future. + * The **absence** of a vulnerability entry does **not** indicate that BCEL is unaffected. + * If a version of BCEL is not listed under the `affects` section of a vulnerability, that version may still be affected or not. + * Only the **latest major version** of BCEL is currently assessed for vulnerabilities. + * The `analysis` field in the VEX file uses **Markdown** formatting. + + + + \ No newline at end of file