{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public, no restriction of redistribution.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Assessment of every known vulnerability of a component that E-Rechnung Prüfer 0.4.0 contains or derives from (pedigree in the SBOM). The same statements are published as CycloneDX VEX (vex.cdx.json) beside the SBOM (sbom.cdx.json).",
        "title": "Summary"
      },
      {
        "category": "legal_disclaimer",
        "text": "Assessments as of the dates of the revision history, provided without warranty. E-Rechnung Prüfer is free software under the EUPL-1.2 (liability and warranty: articles 7 and 8 of the licence).",
        "title": "Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "E-Mail: ahnazarovser@gmail.com; vertrauliche Meldungen: https://github.com/SerhiiAkhnazarov/e-rechnung-pruefer/security/advisories/new; Meldewege und Fristen: https://serhiiakhnazarov.github.io/e-rechnung-pruefer/security-contact/",
      "issuing_authority": "Hersteller des E-Rechnung Prüfers (Serhii Akhnazarov, natürliche Person, Wien, Österreich); Richtlinie zur koordinierten Offenlegung: https://serhiiakhnazarov.github.io/e-rechnung-pruefer/cvd-policy/",
      "name": "Serhii Akhnazarov",
      "namespace": "https://serhiiakhnazarov.github.io/e-rechnung-pruefer/"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL of this document",
        "url": "https://serhiiakhnazarov.github.io/e-rechnung-pruefer/.well-known/csaf/white/2026/e-rechnung-pruefer-vex-0_4_0.json"
      },
      {
        "category": "external",
        "summary": "CycloneDX VEX of the current version",
        "url": "https://serhiiakhnazarov.github.io/e-rechnung-pruefer/vex.cdx.json"
      },
      {
        "category": "external",
        "summary": "Software bill of materials (CycloneDX 1.6, BSI TR-03183-2) of version 0.4.0",
        "url": "https://github.com/SerhiiAkhnazarov/e-rechnung-pruefer/releases/download/v0.4.0/sbom.cdx.json"
      }
    ],
    "title": "E-Rechnung Prüfer 0.4.0: VEX (vulnerabilities of components the program derives from)",
    "tracking": {
      "current_release_date": "2026-10-21T20:33:00Z",
      "id": "E-RECHNUNG-PRUEFER-VEX-0.4.0",
      "initial_release_date": "2026-10-21T20:33:00Z",
      "revision_history": [
        {
          "date": "2026-10-21T20:33:00Z",
          "number": "1",
          "summary": "Initial version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "0.4.0",
                "product": {
                  "name": "E-Rechnung Prüfer 0.4.0",
                  "product_id": "CSAFPID-0001",
                  "product_identification_helper": {
                    "purl": "pkg:github/serhiiakhnazarov/e-rechnung-pruefer@v0.4.0",
                    "sbom_urls": [
                      "https://github.com/SerhiiAkhnazarov/e-rechnung-pruefer/releases/download/v0.4.0/sbom.cdx.json"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "E-Rechnung Prüfer"
          }
        ],
        "category": "vendor",
        "name": "Serhii Akhnazarov"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-14338",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "flags": [
        {
          "date": "2026-10-21T00:00:00Z",
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "CSAFPID-0001"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "GitHub Security Advisory Database",
          "text": "GHSA-w4jq-qh47-hvjq"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "XMLSchemaValidator of Xerces (JAXP) did not enforce the feature use-grammar-pool-only: a crafted document could make the validator load and use a schema grammar named by the document (same flaw as CVE-2020-14621 in OpenJDK).",
          "title": "Description"
        },
        {
          "category": "details",
          "text": "Concerns Apache Xerces-J (XMLSchemaValidator), from which src/xsd-validator.js of the program derives (pedigree in the SBOM).",
          "title": "Component"
        }
      ],
      "product_status": {
        "known_not_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD: CVE-2020-14338",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14338"
        },
        {
          "category": "external",
          "summary": "GitHub Advisory Database: GHSA-w4jq-qh47-hvjq",
          "url": "https://github.com/advisories/GHSA-w4jq-qh47-hvjq"
        },
        {
          "category": "external",
          "summary": "NVD: CVE-2020-14621 (same flaw, other product)",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14621"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-21T00:00:00Z",
          "details": "src/xsd-validator.js follows the assessment order of XMLSchemaValidator but contains no grammar loading at all: it validates only against the schema models compiled from the official XSDs and embedded in the page; xsi:schemaLocation and xsi:noNamespaceSchemaLocation are accepted and never followed (no resolver, no network access – Content-Security-Policy connect-src 'none'). A root element without declaration is reported as cvc-elt.1.a, as by the fixed Xerces with use-grammar-pool-only. The OpenJDK 21 sources it follows contain the fix of CVE-2020-14621.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2022-23437",
      "cwe": {
        "id": "CWE-91",
        "name": "XML Injection (aka Blind XPath Injection)"
      },
      "flags": [
        {
          "date": "2026-10-21T00:00:00Z",
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "CSAFPID-0001"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "GitHub Security Advisory Database",
          "text": "GHSA-h65f-jvqw-m9fj"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The Xerces-J XML parser enters an infinite loop on specially crafted XML document payloads.",
          "title": "Description"
        },
        {
          "category": "details",
          "text": "Concerns Apache Xerces-J (XML parser), from which src/xsd-validator.js of the program derives (pedigree in the SBOM).",
          "title": "Component"
        }
      ],
      "product_status": {
        "known_not_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD: CVE-2022-23437",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23437"
        },
        {
          "category": "external",
          "summary": "GitHub Advisory Database: GHSA-h65f-jvqw-m9fj",
          "url": "https://github.com/advisories/GHSA-h65f-jvqw-m9fj"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-21T00:00:00Z",
          "details": "The flaw is in the XML scanner of Xerces. src/xsd-validator.js contains no XML parser: it validates a DOM that the browser's own parser (DOMParser) or, in the Node tests, slimdom produced; no code of the Xerces scanner was translated. Hostile XML is additionally bounded by the refusal of document type declarations and the nesting limit (src/pruefer-core.js, suite robustness).",
          "product_ids": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2013-4002",
      "cwe": {
        "id": "CWE-112",
        "name": "Missing XML Validation"
      },
      "flags": [
        {
          "date": "2026-10-21T00:00:00Z",
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "CSAFPID-0001"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "GitHub Security Advisory Database",
          "text": "GHSA-7j4h-8wpf-rqfh"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0 allows a denial of service via vectors related to XML attribute names.",
          "title": "Description"
        },
        {
          "category": "details",
          "text": "Concerns Apache Xerces-J (XMLScanner), from which src/xsd-validator.js of the program derives (pedigree in the SBOM).",
          "title": "Component"
        }
      ],
      "product_status": {
        "known_not_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD: CVE-2013-4002",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4002"
        },
        {
          "category": "external",
          "summary": "GitHub Advisory Database: GHSA-7j4h-8wpf-rqfh",
          "url": "https://github.com/advisories/GHSA-7j4h-8wpf-rqfh"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-21T00:00:00Z",
          "details": "The flaw is in XMLScanner (parsing of attribute names). src/xsd-validator.js contains no XML scanner or parser; it validates an already parsed DOM.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2012-0881",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "flags": [
        {
          "date": "2026-10-21T00:00:00Z",
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "CSAFPID-0001"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "GitHub Security Advisory Database",
          "text": "GHSA-vmqm-g3vh-847m"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Apache Xerces2 Java Parser before 2.12.0 allows a denial of service (CPU consumption) via a crafted message that triggers hash table collisions.",
          "title": "Description"
        },
        {
          "category": "details",
          "text": "Concerns Apache Xerces-J (SymbolTable), from which src/xsd-validator.js of the program derives (pedigree in the SBOM).",
          "title": "Component"
        }
      ],
      "product_status": {
        "known_not_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD: CVE-2012-0881",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-0881"
        },
        {
          "category": "external",
          "summary": "GitHub Advisory Database: GHSA-vmqm-g3vh-847m",
          "url": "https://github.com/advisories/GHSA-vmqm-g3vh-847m"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-21T00:00:00Z",
          "details": "The flaw is in the parser's symbol table (hash collisions of names). src/xsd-validator.js contains neither the parser nor its symbol table; names are compared as JavaScript strings in Map objects of the JavaScript engine.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2009-2625",
      "flags": [
        {
          "date": "2026-10-21T00:00:00Z",
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "CSAFPID-0001"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "GitHub Security Advisory Database",
          "text": "GHSA-334p-wv2m-w3vp"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "XMLScanner.java in Apache Xerces2 Java allows a denial of service (infinite loop and application hang) via malformed XML input.",
          "title": "Description"
        },
        {
          "category": "details",
          "text": "Concerns Apache Xerces-J (XMLScanner), from which src/xsd-validator.js of the program derives (pedigree in the SBOM).",
          "title": "Component"
        }
      ],
      "product_status": {
        "known_not_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD: CVE-2009-2625",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-2625"
        },
        {
          "category": "external",
          "summary": "GitHub Advisory Database: GHSA-334p-wv2m-w3vp",
          "url": "https://github.com/advisories/GHSA-334p-wv2m-w3vp"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-21T00:00:00Z",
          "details": "The flaw is in XMLScanner. src/xsd-validator.js contains no XML scanner or parser; malformed XML is rejected by the browser's parser before validation (suite robustness, robustness-browser-*).",
          "product_ids": [
            "CSAFPID-0001"
          ]
        }
      ]
    }
  ]
}