{
  "review_date": "2026-10-05",
  "release": "4.7.0-20261005-r2",
  "plugin": "1.21.0",
  "confirmed_unpatched_critical": 0,
  "confirmed_unpatched_high": 0,
  "confirmed_medium": 1,
  "raw_scanner_matches": {
    "CRITICAL": 1,
    "HIGH": 4
  },
  "dispositions": {
    "patched_backport": 1,
    "fixed_artifact_version_mismatch": 1,
    "stale_metadata_no_affected_class": 3
  },
  "jar_paths": 511,
  "identified_jar_paths": 372,
  "unidentified_jar_paths": 139,
  "production_clearance": false,
  "channels_deployed": false,
  "product_modified": false,
  "finding": "Foreground startup creates sensitive files with 0644 permissions; exposure depends on parent directory access.",
  "assessment_owner": "Globalesm",
  "assessment_type": "Internal artifact review and focused security tests; not independent certification",
  "scope": [
    "Connect Hub 4.7.0 revision 2 distributed engine artifacts",
    "Bundled Hub plugin 1.21.0",
    "Dependency triage and JAR integrity",
    "Isolated macOS ARM64 runtime authentication and file permissions",
    "Synthetic PHI restriction probes using mock output"
  ],
  "excluded": [
    "Cloud Hub backend",
    "Production configurations and customer channel code",
    "Separately installed Java/JavaFX and operating systems",
    "Windows runtime and ACLs",
    "End-to-end paired Hub PHI verification"
  ],
  "open_findings": [
    {
      "severity": "MEDIUM",
      "title": "Foreground startup file permissions",
      "status": "Open",
      "impact": "Sensitive runtime files can be read by other local users if installation parent directories allow traversal.",
      "observed_permissions": "0644",
      "mitigation": "Evaluate under a dedicated account in a private installation directory. The supplied Linux systemd unit uses UMask=0077. Terminal launchers still need equivalent enforcement.",
      "limitation": "The test used a private directory; cross-user access was not demonstrated."
    }
  ],
  "checks": {
    "protected_unauthenticated_routes": 5,
    "session_rotation": "passed",
    "plugin_test_suites": 9,
    "focused_core_regressions": 12,
    "synthetic_phi_checks": 881,
    "outbound_response_cases": 12,
    "jar_signatures_verified": 230,
    "signing": "Self-signed development certificate; integrity verified, trusted publisher identity not established"
  },
  "upstream": {
    "product": "Open Integration Engine",
    "version": "4.6.0",
    "release_commit": "cd1110e",
    "relationship": "Release commit is an ancestor of reviewed Connect Hub source; no assertion that all subsequent changes are included.",
    "release_notes": "https://github.com/OpenIntegrationEngine/engine/releases/tag/v4.6.0",
    "equivalent_current_binary_scan_performed": false
  },
  "manifest": "https://downloads.globalesm.com/connect-hub/4.7.0-20261005-r2/release.json",
  "artifacts": [
    {
      "file": "INSTALL-LINUX.txt",
      "sha256": "2c6b51b9a55c9c0296553a5724fa6cef0952906ce5d45be492ac40ac09e8cafd",
      "bytes": 3955
    },
    {
      "file": "INSTALL-MACOS.txt",
      "sha256": "32ad5164b0447b28dbe87e0c2d23d52b8ae4c944f35c92e9c942017362b7af61",
      "bytes": 2934
    },
    {
      "file": "INSTALL-WINDOWS.txt",
      "sha256": "db3432b3b2477b66c0dfc1c00126d3da7986aaa3236620923b6430daafa5cd56",
      "bytes": 3122
    },
    {
      "file": "connect-hub-4.7.0-linux-early-access-20261005-r2.tar.gz",
      "sha256": "9b8b5d580ecf7196795c752f2f8c07ef6aa4149b6504d9879678efa0f5592b3c",
      "bytes": 253677877
    },
    {
      "file": "connect-hub-4.7.0-macos-early-access-20261005-r2.zip",
      "sha256": "e32b14b59ffd43c00153586aba6ed9505dd10b9a128301793ada82791c95845d",
      "bytes": 254026179
    },
    {
      "file": "connect-hub-4.7.0-windows-early-access-20261005-r2.zip",
      "sha256": "30c171c8a74e5b6b5d2df87b464107300964db8a407f102d4bbb8f905acb28b3",
      "bytes": 254026003
    },
    {
      "file": "connect-hub.service",
      "sha256": "ae6033c5ee4e49e0c256a46fb4d3e5cc3bab4cd64d16f11c74087c2fd95b6e5f",
      "bytes": 376
    },
    {
      "file": "globalesm-hub-1.21.0-connect-hub-4.7.0.zip",
      "sha256": "feb1bdf2ef08b5488b120f0732e9e7b5880c391ab0a4bcd70d21c8f6bb53987a",
      "bytes": 327503
    }
  ],
  "scan_dispositions": [
    {
      "cve": "CVE-2022-46337",
      "count": 1,
      "scanner_severity": "CRITICAL",
      "disposition": "DERBY-7147 backport; packaged-class regression passed."
    },
    {
      "cve": "CVE-2025-59250",
      "count": 1,
      "scanner_severity": "HIGH",
      "disposition": "Bundled JAR SHA-256 matches official fixed Microsoft JDBC 12.10.2.jre11."
    },
    {
      "cve": "CVE-2024-47554",
      "count": 3,
      "scanner_severity": "HIGH",
      "disposition": "Stale Commons IO metadata in Velocity; affected class absent there, actual packaged copies are Commons IO 2.21.0."
    }
  ]
}