CSI baseline CSI-IFX-2026-10-22 · 22 October 2026. Limited to the registered source set. Application execution and proposed tests were not run; source findings do not establish runtime behaviour.

Informix4GL Demo: assessment overview

Dated baseline: 22 October 2026 · Assessment of retained documentation and external source checks

What this assessment establishes

The declared launch dependencies include itext-2.1.7.jar. The iText vendor identifies the iText 2 family as unsupported, and a reviewed advisory lists an affected package range that includes 2.1.7 if the jar is confirmed to be com.lowagie:itext. These are two distinct findings: a support issue on the declaration and a vulnerability candidate whose application relevance remains unresolved. IFX-S-E0014 IFX-S-ITEXT-EOL IFX-S-XXE

The most useful next step is to identify the exact jar and establish where the application calls it. The retained material describes reporting and order-entry behaviour, but it does not supply the report-framework implementation or prove that iText participates in those paths. It also does not establish a vulnerable PDF/XML parser receiving untrusted input. IFX-S-E0012 IFX-S-C10

Harten has organised the evidence into eight component records, four findings and five verification tasks. All five tasks remain not run. This is a dated assessment; it does not report an observed production vulnerability or a continuously monitored deployment. IFX-S-STATUS IFX-S-PROVENANCE IFX-S-C13

The four findings and the decisions they support

Finding evidence: IFX-S-E0014 IFX-S-ITEXT-EOL IFX-S-XXE IFX-S-IBM-JRE IFX-S-IBM-20515.

Application context that matters to a change

The retained documentation describes a desktop order-management demonstration with related Java and Informix-4GL materials. The Java launch path uses D4_Main. Its documented reporting surfaces include mailing labels, accounts receivable and invoices. The order-creation path commits the order header and item rows before invoking invoice generation. That ordering makes transaction state, invoice invocation and report output useful regression checks for a library or framework change. It does not establish vulnerability reachability. IFX-S-C07 IFX-S-C08 IFX-S-E0012

The Java and 4GL materials must be treated as distinct implementation evidence. Similar menus and names do not demonstrate that they run together or behave identically. Some Java menu operations are explicit stubs, and unavailable framework behaviour prevents a complete account of report buffering, exception cleanup and monetary rounding. The verification plan identifies the executable and the behaviour to observe before comparing results. IFX-S-C13 IFX-S-C14

Recommended sequence

1. Bind the assessed build and environment: IFX-V-001. Obtain the source identifier, jar manifests and hashes, server fix pack and edition, image digest, and Java/JDBC/framework versions.
2. Resolve the iText use boundary: IFX-V-002. Identify the report framework's library calls and any PDF/XML parsing paths, their input origins and controls.
3. Capture current behaviour: IFX-V-003 and IFX-V-004. Characterise report destinations, order commit and failure paths, invoice invocation and totals before changing their dependencies.
4. Verify the chosen upgrade: IFX-V-005. Once a server target is selected, check its prerequisites and run the agreed database and application regressions in an isolated environment.

These are proposed next steps. Their scope and evidence requirements are developed in the action and verification reports. IFX-S-PROVENANCE IFX-S-E0014 IFX-S-E0012 IFX-S-C13 IFX-S-IBM-JRE

How to read this report set

The component inventory explains what is known about each dependency. The vulnerability and support reports separate candidate, rejected and conditional findings. The impact graphs show where documented relationships stop. The action plan and verification plan turn those gaps into reviewable work. The evidence register preserves source titles, dates, public links and unsuccessful lookup outcomes. The baseline report defines what a later assessment must compare.

External observations are dated 22 October 2026 and were imported from the preserved assessment. Preparing these reports did not refresh those sources or execute the application. Retained application evidence is identified by citation and kept for review; its private locations are not included in this public edition.