CSI baseline CSI-IFX-2026-10-22 · 22 October 2026. Limited to the registered source set. Application execution and proposed tests were not run; source findings do not establish runtime behaviour.

Informix4GL Demo: impact graphs and relationship evidence

Dated baseline: 22 October 2026 · Evidence model

How to interpret the graphs

These graphs connect external notices, component declarations, documented application behaviour and proposed verification. They are assembled from the retained assessment. They do not represent an executed trace or an export from a live monitoring service.

The baseline preserves 22 relationships. The diagrams show the important paths; the register below retains the source mapping for every relationship.

Vulnerability candidate and report boundary

flowchart TD
  A["CVE-2017-9096"] -->|"Inferred version match"| B["Declared iText 2.1.7"]
  B -->|"Documented classpath entry"| C["Java launch"]
  B -.->|"Unresolved library use"| D["Report framework"]
  E["Mailing labels"] -->|"Documented report lifecycle"| D
  F["Accounts receivable"] -->|"Documented report lifecycle"| D
  G["Successful order commit"] -->|"Documented invocation"| H["Invoice generation"]
  H -->|"Documented report lifecycle"| D

The unresolved iText-to-framework edge prevents the diagram from establishing that any of the three report callers is affected by the advisory. The framework and its callers would still need a separate parser review to establish vulnerable PDF/XML parsing, input origin and controls. Order commit followed by invoice generation is application context, not proof of that parsing route. IFX-S-E0012 IFX-S-E0014 IFX-S-XXE

iText lifecycle decision and verification

flowchart TD
  A["Vendor: iText 2 unsupported"] -->|"Inferred family correlation"| B["Declared iText 2.1.7"]
  B -->|"Proposed identity and use review"| C["IFX-V-001 and IFX-V-002"]
  C -.->|"If proven unused"| D["Consider removal"]
  C -.->|"If required"| E["Select supported replacement"]
  D -->|"Proposed behaviour checks"| F["IFX-V-003 and IFX-V-004"]
  E -->|"Proposed behaviour checks"| F

The decision branches are proposed work, not baseline graph assertions that removal or migration is already warranted. Identity and use determine the change. Report destinations, transaction outcomes and invoice totals provide specific behaviour to preserve or deliberately change. IFX-S-ITEXT-EOL IFX-S-E0012 IFX-S-C13

Informix target and Java prerequisite

flowchart TD
  A["Declared Informix FC5 archive"] -->|"Proposed environment inventory"| B["IFX-V-001"]
  B -->|"Proposed target decision"| C["Exact server and platform target"]
  D["IBM Java packaging change"] -->|"Documented target constraint"| C
  C -.->|"Unresolved Java provision"| E["Required Java environment"]
  C -->|"Proposed verification"| F["IFX-V-005"]
  E -->|"Proposed verification"| F
  F -->|"Proposed regression scope"| G["Startup, JDBC, orders and invoices"]

The Java prerequisite is conditional on the selected server target. The current FC5 declaration is not evidence of a Java failure, and the alternate mutable database image is not bound to that fix pack. IFX-S-IBM-JRE IFX-S-C10 IFX-S-E0014

Baseline relationship register

“Documented proposal” means that the retained source proposes the scenario. It does not change the verification task's not-run status. “Inferred verification need” records the assessment's reason for requesting evidence.

What would change the impact assessment

IFX-V-001 can turn filename-based correlations into artifact-specific comparisons. IFX-V-002 can resolve the missing iText use edge and the distinct parser-applicability question. IFX-V-003 and IFX-V-004 can replace proposed behaviour checks with observed results for a named build. IFX-V-005 can establish whether a selected server/Java/JDBC combination works with the application. None of these outcomes is assumed in the baseline. IFX-S-E0014 IFX-S-E0012 IFX-S-C13 IFX-S-IBM-JRE