{
  "repository": "https://releases-docker.jfrog.io/jfrog/artifactory-jcr",
  "commit_source": "image_build_metadata",
  "commit_sha": null,
  "submitted_target": {
    "target_kind": "docker_image",
    "version": "7.146.25",
    "ref": "releases-docker.jfrog.io/jfrog/artifactory-jcr:7.146.25",
    "image_id": "sha256:1734bd9277874ce6a29239fbbe0fe21befa9588ba59b21f724deaee77a4f9c57",
    "build_revision": "84625900",
    "build_timestamp": "20260706162936",
    "display": "JFrog Artifactory JCR 7.146.25 (vulnerable; bundled Access 7.176.15)"
  },
  "variant_target": {
    "target_kind": "docker_image",
    "version": "7.146.38",
    "ref": "releases-docker.jfrog.io/jfrog/artifactory-jcr:7.146.38",
    "image_id": "sha256:a94c9a8e27a6542bdca359a928cbb50f6aa2732c135291a13e17bde3a5c3996b",
    "build_revision": "84638900",
    "build_timestamp": "20260827214011",
    "display": "JFrog Artifactory JCR 7.146.38 (fixed; bundled Access 7.176.28)"
  },
  "notes": "Proprietary closed-source product: no public git commit SHA exists. Exact tested identity is pinned by (1) immutable image IDs from `docker image inspect`, and (2) embedded /opt/jfrog/artifactory/app/artifactory.product.version.properties (version + build revision + timestamp), captured in logs/vuln_variant/vuln_version.txt and logs/vuln_variant/fixed_version.txt. Static analysis used access-server-{api,core,rest,grpc}-7.176.15 (vuln) and 7.176.28 (fixed) jars extracted from those exact images into vuln_variant/decomp/. Variants were confirmed on the 7.146.25 build and ruled out as bypasses on the 7.146.38 build."
}