Informix 4GL case study
Wayfinder / Case study / CSI reports

CSI baseline CSI-IFX-2026-10-22 · 22 October 2026. Limited to the registered source set. Application execution and proposed tests were not run; source findings do not establish runtime behaviour.

Informix4GL Demo: evidence register and lookup record

In this document

Baseline observation date: 22 October 2026 · Publication uses preserved observations

What this register records

This register lists the 17 sources used by the assessment: 11 retained application-evidence records and six external vendor or advisory sources. It summarises eight bounded coverage outcomes, including non-results and incomplete retrievals. The dates identify observations from the original assessment; later checks do not replace this dated baseline.

Public vendor and advisory URLs are provided directly. Private application evidence is marked retained for review with its original citation ID and a descriptive title. Its location, raw contents and operational metadata are excluded from this public edition.

Retained application evidence

All records in this section were observed in the baseline on 22 October 2026 and imported for this publication. They are retained for review; no public source URL is provided.

IFX-S-README

Informix4GL Demo: case introduction

Type: Retained documentation. Observed: 22 October 2026. Access: retained for review; private source URL excluded.

Scope of the available documentation and the distinction between a reference revision and an attested analysed input.

IFX-S-STATUS

Informix4GL Demo: evidence and status

Type: Retained status record. Observed: 22 October 2026. Access: retained for review; private source URL excluded.

Available documentation output; no established later specification, modernisation implementation or production result.

IFX-S-PROVENANCE

Informix4GL Demo: source reference

Type: Retained provenance record. Observed: 22 October 2026. Access: retained for review; private source URL excluded.

Exact analysed source revision remains unbound.

IFX-S-C07

System context and components

Type: Retained generated documentation. Observed: 22 October 2026. Access: retained for review; private source URL excluded.

Java/module structure, desktop boundary, order and report responsibilities, and framework limits.

IFX-S-C08

Integration catalogue

Type: Retained generated documentation. Observed: 22 October 2026. Access: retained for review; private source URL excluded.

Database exchanges, customer/order/item data, labels, accounts receivable and output destinations.

IFX-S-C09

Security and trust boundaries

Type: Retained generated documentation. Observed: 22 October 2026. Access: retained for review; private source URL excluded.

Static concerns and missing framework/deployment evidence; no claim of deployed exploitation.

IFX-S-C10

Deployment and operations

Type: Retained generated documentation. Observed: 22 October 2026. Access: retained for review; private source URL excluded.

Launch dependencies, database setup routes and unresolved Java/JDBC/framework identities.

IFX-S-C13

Proposed characterisation tests

Type: Retained test proposal. Observed: 22 October 2026. Access: retained for review; private source URL excluded.

Startup, orders, rollback, invoices, totals and report destinations; all proposed.

IFX-S-C14

Hazards, unknowns and backlog

Type: Retained generated documentation. Observed: 22 October 2026. Access: retained for review; private source URL excluded.

Implementation distinctions and transaction, reporting and deployment gaps.

IFX-S-E0014

Deployment declaration evidence

Type: Retained evidence summary. Observed: 22 October 2026. Access: retained for review; private source URL excluded.

Jar filenames, Informix FC5 archive and mutable database image.

IFX-S-E0012

Report and order-flow evidence

Type: Retained evidence summary. Observed: 22 October 2026. Access: retained for review; private source URL excluded.

Named callers, transaction ordering, and unavailable report, monetary and exception-handling semantics.

“Retained” identifies the evidence available for review. It does not mean that an application or a proposed test was executed for this publication.

External source register

IFX-S-ITEXT-EOL

iText 2 legacy product page

  • Type and reference source: vendor lifecycle statement; iText website.
  • Public URL: iText 2.
  • Observed: 22 October 2026 in the preserved baseline.
  • Recorded outcome: iText 2 is identified as end of life and unsupported. This supports IFX-F-001 when correlated with the declared 2.1.7 jar. Binary identity and actual callers remain unverified.

IFX-S-XXE

GHSA-86p9-x5pw-94qx / CVE-2017-9096

  • Type and reference database: reviewed advisory; GitHub Advisory Database.
  • Public URL: GHSA-86p9-x5pw-94qx.
  • Observed: 22 October 2026 in the preserved baseline.
  • Recorded outcome: affected coordinate com.lowagie:itext <= 4.2.2; no patched version listed in that coordinate; XML external-entity handling involving crafted PDF input. This supports IFX-F-002 as a candidate pending package and parsing-path evidence.

IFX-S-IBM-JRE

Informix server system requirements

  • Type and reference source: vendor compatibility and installation requirements; IBM Support.
  • Public URL: Informix server system requirements.
  • Observed: 22 October 2026 in the preserved baseline. The retained record notes a page modification date of 15 January 2026.
  • Recorded outcome: bundled Java removed from 14.10.FC11 onward and 15.0; Java 11 specified for 14.10.FC11W1 and later. IFX-F-003 applies conditionally to the selected upgrade target.

IFX-S-IBM-20515

Informix CVE-2021-20515 bulletin

  • Type and reference source: vendor security bulletin; IBM Support.
  • Public URL: IBM Informix Dynamic Server stack-based buffer-overflow bulletin.
  • Observed: 22 October 2026 in the preserved baseline.
  • Recorded outcome: the bulletin names the 14.10 family and lists 14.10.xC5 as remediation. IFX-F-004 rejects a family-only positive match for the declared FC5 archive. The actual server remains unverified.

IFX-S-IBM-LIFECYCLE

Informix Enterprise Edition 14.10.x lifecycle

  • Type and reference source: vendor product lifecycle page; IBM Support.
  • Public URL: IBM Informix Enterprise Edition 14.10.x.
  • Observed: 22 October 2026 in the preserved baseline.
  • Recorded outcome: no end-of-support date appeared in the retrieved page. With the installed edition and entitlement unknown, the assessment establishes neither an Informix EOL finding nor affirmative support coverage.

IFX-S-IBM-LOG4J

Informix Log4j technical note

  • Type and reference source: vendor security technical note; IBM Support.
  • Public URL: Log4j CVE-2021-44228 and IBM Informix workaround note.
  • Observed: 22 October 2026 in the preserved baseline.
  • Recorded outcome: the described condition concerns InformixHQ 1.5.0 in 14.10.xC6 or 12.10.xC15 and higher. Retained FC5 and absent HQ-use evidence do not establish that scenario. Linked bulletin pages timed out; the assessment makes no broad Log4j clearance.

External reference coverage

The eight coverage outcomes below were recorded on 22 October 2026. They retain the positive, rejected, conditional and unresolved results relevant to this assessment, together with the limits of the available evidence.

Subject Reference source or database Result and limit
iText 2 lifecycle iText vendor website. IFX-S-ITEXT-EOL The unsupported-family statement supports the declaration-based lifecycle finding. Jar identity and actual use remain unverified.
iText XML external-entity advisory GitHub Advisory Database. IFX-S-XXE The advisory establishes a candidate coordinate and affected range. The package identity, parser path and deployment remain unproven.
Informix CVE-2021-20515 IBM Support security bulletin. IFX-S-IBM-20515 The bulletin lists 14.10.xC5 as remediation. This rejects a family-only positive match for the declared FC5 archive. The actual server remains unverified, and coverage is not an exhaustive Informix advisory review.
Informix Log4j condition IBM Support technical note. IFX-S-IBM-LOG4J The recorded condition concerns particular InformixHQ distributions. Linked bulletin requests timed out. The retained evidence supports neither a broad Log4j clearance nor a remediation recommendation.
Informix 14.10.x support status IBM Support lifecycle page. IFX-S-IBM-LIFECYCLE No end-of-support date appeared in the retrieved content. Installed edition and entitlement remain unknown, so neither an EOL finding nor affirmative support coverage is established.
Informix Java prerequisites IBM Support system requirements. IFX-S-IBM-JRE A conditional Java packaging and prerequisite change is recorded. Its applicability depends on the chosen upgrade target; the current runtime remains unknown.
SwingX 1.6.4 Bounded GitHub Advisory Database and wider public-reference coverage No applicable authoritative advisory or lifecycle notice was established. This is not proof of safety, support or absence of advisories.
JDBC, framework, Java and mutable-image identities Retained application documentation and deployment evidence. IFX-S-C10 IFX-S-E0014 The available identities are insufficient for precise matching. Missing identities remain unresolved; no upstream-source or runtime discoveries were used to fill the gaps.

Coverage and provenance limits

Only the named vendor sources, advisory record and bounded reference coverage are claimed. This report does not imply a scan of every vulnerability database, a complete transitive audit or a fresh check of the current contents of the linked pages. Public sources can change after the observation date; those changes do not alter the preserved baseline.

A later technical review can use the citation IDs to request the retained evidence and evaluate the specific finding or relationship it supports. These public reports contain conclusions and their limits, not the raw evidence pack.

This Wayfinder CSI assessment is limited to the registered source set. Findings, inference, recommendations and evidence gaps remain distinct. It does not establish a completed migration, production suitability or functional equivalence.

Independent Harten analysis of the Informix4GL Demo source material. No maintainer endorsement is implied. The exact analysed upstream revision remains unbound. The source records do not establish runtime behaviour or equivalence between the 4GL and Java implementations.

Inspect the evidence and external lookups · Read the existing application documentation edition.