CSI baseline CSI-IFX-2026-10-22 · 22 October 2026. Limited to the registered source set. Application execution and proposed tests were not run; source findings do not establish runtime behaviour.
Informix4GL Demo: vulnerability assessment
In this document
Dated baseline: 22 October 2026 · One qualified candidate and one rejected declared-version match
Assessment result
The evidence supports a specific iText advisory candidate. It does not establish that the application's deployed binary contains the affected code or that a vulnerable parser is reachable with untrusted input. A separate Informix candidate is rejected for the declared FC5 archive because IBM identifies that fix level as the remediation. Neither result provides an environment-wide security clearance. IFX-S-E0014 IFX-S-XXE IFX-S-IBM-20515
No application severity score, observed exploit or confirmed production vulnerability is assigned by this assessment. That decision follows from the missing deployment identity and application path, rather than from an assumption that the dependency is harmless. IFX-S-PROVENANCE IFX-S-E0012 IFX-S-C10
IFX-F-002: candidate CVE-2017-9096 match
Status: externally correlated at declared-component level; application applicability unresolved.
The retained classpath names itext-2.1.7.jar. GitHub Reviewed advisory GHSA-86p9-x5pw-94qx, associated with CVE-2017-9096, lists com.lowagie:itext <= 4.2.2 as affected and gives no patched version within that coordinate. Version 2.1.7 fits the range if the filename identifies that package. The advisory concerns XML external-entity handling involving PDF/XML parsing. IFX-S-E0014 IFX-S-XXE
What is established, inferred and unknown
| Question | Baseline evidence | Assessment |
|---|---|---|
| Is iText declared? | The launch classpath names the jar. | Documented declaration. |
Is the jar exactly com.lowagie:itext version 2.1.7? |
The filename is the available identity clue; no binary attestation is retained. | Inferred candidate identity. |
| Does that version fit the advisory range? | The registry lists <= 4.2.2. |
Yes, conditional on package identity. |
| Does the report framework use iText? | Framework implementation and library calls are unavailable. | Unresolved. |
| Does the application call the vulnerable PDF/XML parser? | Retained material describes report output. | Unresolved; output generation alone does not establish parsing. |
| Can untrusted input reach the parser under relevant conditions? | Input origins, parser configuration and runtime controls are not established. | Unresolved. |
Sources: IFX-S-E0014 IFX-S-E0012 IFX-S-C08 IFX-S-XXE.
The reporting functions are useful places to investigate, because the documentation names their report lifecycle. They are not a confirmed affected-callers list. In particular, the invoice call after successful order commit describes business ordering; it does not show that an attacker-controlled PDF or XML document reaches iText. IFX-S-E0012 IFX-S-C13
Evidence required for a disposition
IFX-V-001 must identify the exact jar, including any fork or applied patch. IFX-V-002 must then locate the relevant parsing entry points and callers, establish whether the code runs in the assessed environment, and document input origin and parser controls. Static inspection or a trustworthy use map may resolve part of this; any later runtime validation should record the exact build and controlled test conditions. These tasks are not run. IFX-S-E0014 IFX-S-E0012 IFX-S-XXE
If the candidate is confirmed applicable, the change assessment must establish that the chosen maintained replacement addresses the relevant parsing behaviour. The advisory's empty patched-version field does not identify a safe later version in the old coordinate. If parsing is absent from the assessed application path, retain that evidence with the candidate disposition; IFX-F-001's lifecycle finding still needs its own decision. IFX-S-XXE IFX-S-ITEXT-EOL
IFX-F-004: CVE-2021-20515 rejected for the declared FC5 archive
Status: rejected family-only match, limited to the declared installation target.
IBM's bulletin names the Informix 14.10 family and identifies 14.10.xC5 as the fix. The retained installer declaration names ibm.ids.14.10.FC5.LNX.tar. Matching only the product family would therefore produce a misleading positive result for that declared fix level. The assessment preserves the rejection and its rationale. IFX-S-IBM-20515 IFX-S-E0014
The installed server has not been observed, and the alternative container route is recorded as a mutable latest tag. Neither is cleared by the FC5 archive comparison. IFX-V-001 must establish the actual server and patch provenance before an environment-specific alert can be closed. A different build requires a new comparison against the bulletin. IFX-S-C10 IFX-S-E0014
Other bounded checks
IBM's retained Log4j technical note describes a condition involving InformixHQ 1.5.0 in specified later fix-pack distributions. The FC5 archive declaration and the absence of retained HQ-use evidence do not establish that scenario. Linked bulletin retrievals timed out in the original lookup sequence, so this assessment makes no broad Log4j clearance or remediation claim. IFX-S-IBM-LOG4J
The bounded SwingX searches did not establish an applicable authoritative advisory. Missing JDBC, framework, Java and image identities also prevented precise matching. These outcomes describe the limits of the review; they do not establish that no relevant advisory exists. The evidence report records the external reference coverage and its limits. IFX-S-C10 IFX-S-E0014
This Wayfinder CSI assessment is limited to the registered source set. Findings, inference, recommendations and evidence gaps remain distinct. It does not establish a completed migration, production suitability or functional equivalence.
Independent Harten analysis of the Informix4GL Demo source material. No maintainer endorsement is implied. The exact analysed upstream revision remains unbound. The source records do not establish runtime behaviour or equivalence between the 4GL and Java implementations.
Inspect the evidence and external lookups · Read the existing application documentation edition.