{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:0d486b74-425d-58b6-a0b7-4545b3204292",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "undertow-servlet",
      "purl": "pkg:maven/io.undertow/undertow-servlet@2.1.7.Final-tuxcare.1",
      "type": "library",
      "group": "io.undertow",
      "bom-ref": "pkg:maven/io.undertow/undertow-servlet@2.1.7.Final-tuxcare.1",
      "version": "2.1.7.Final-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "undertow-servlet",
            "purl": "pkg:maven/io.undertow/undertow-servlet@2.1.7.Final",
            "type": "library",
            "group": "io.undertow",
            "version": "2.1.7.Final"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2019-10184",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.1.7.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d36bdc11-9275-537f-a3b9-e0a90774d116",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-10184 does not affect version 2.1.7.Final-tuxcare.1 of io.undertow:undertow-servlet. The target (Undertow 2.1.7.Final) is not affected by CVE-2019-10184. The vulnerability was fixed in upstream commit d2715e3a (July 24, 2019), which shipped in Undertow 2.0.23.Final and all subsequent versions including 2.1.7.Final. The fix introduces RedirectDirHandler that processes directory redirects BEFORE security checks, preventing unauthenticated attackers from discovering directory structure through differential responses (redirect vs. authentication challenge). The vulnerable code pattern that allowed this information leak has been removed from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.23), NVD (< 2.0.23), cve.org (< 2.0.23.Final), Snyk (< 2.0.23.Final).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/io.undertow/undertow-servlet@2.1.7.Final-tuxcare.1"
    }
  ]
}