{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:77af23b4-33ec-5554-8b54-e8b4fdab4b18",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "undertow-servlet",
      "purl": "pkg:maven/io.undertow/undertow-servlet@2.2.20.Final-tuxcare.1",
      "type": "library",
      "group": "io.undertow",
      "bom-ref": "pkg:maven/io.undertow/undertow-servlet@2.2.20.Final-tuxcare.1",
      "version": "2.2.20.Final-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "undertow-servlet",
            "purl": "pkg:maven/io.undertow/undertow-servlet@2.2.20.Final",
            "type": "library",
            "group": "io.undertow",
            "version": "2.2.20.Final"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2019-10184",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.2.20.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:781fd31d-c9a2-5541-b0b3-f451a4191ae6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-10184 does not affect version 2.2.20.Final-tuxcare.1 of io.undertow:undertow-servlet. CVE-2019-10184 is not present in Undertow 2.2.20.Final. The vulnerability involved directory structure information leakage when requests to protected directory paths without trailing slashes triggered redirect responses before authentication checks. The upstream fix (commit d2715e3af) introduced RedirectDirHandler and moved redirect logic to execute after security handlers, ensuring unauthenticated requests receive 401 status instead of directory-revealing redirects. This fix shipped in upstream Undertow 2.2.20.Final before TuxCare onboarded the version, so the target inherited the fix from upstream.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.23), NVD (< 2.0.23), cve.org (< 2.0.23.Final), Snyk (< 2.0.23.Final).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-1259",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.2.20.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:3fe84fe7-b71e-5b3c-be8d-7963217605a3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-1259 affects version 2.2.20.Final-tuxcare.1 of io.undertow:undertow-servlet."
      }
    },
    {
      "id": "CVE-2022-2764",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.2.20.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a5bac2f9-c449-5afc-a7d9-76b9e138e9d6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-2764 affects version 2.2.20.Final-tuxcare.1 of io.undertow:undertow-servlet."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/io.undertow/undertow-servlet@2.2.20.Final-tuxcare.1"
    }
  ]
}