{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:7a4644f0-fcee-5ef8-bddb-08a1f5a6e634",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "undertow-servlet",
      "purl": "pkg:maven/io.undertow/undertow-servlet@2.2.28.Final-tuxcare.1",
      "type": "library",
      "group": "io.undertow",
      "bom-ref": "pkg:maven/io.undertow/undertow-servlet@2.2.28.Final-tuxcare.1",
      "version": "2.2.28.Final-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "undertow-servlet",
            "purl": "pkg:maven/io.undertow/undertow-servlet@2.2.28.Final",
            "type": "library",
            "group": "io.undertow",
            "version": "2.2.28.Final"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2019-10184",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.2.28.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:4f9bbb7a-2e79-5e18-8da7-d1ec83569d34",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-10184 does not affect version 2.2.28.Final-tuxcare.1 of io.undertow:undertow-servlet. CVE-2019-10184 is not present in undertow 2.2.28.Final. The vulnerability allowed attackers to probe directory structure through differential responses: requests to protected directories without trailing slashes would receive redirects before authentication, revealing directory existence. The fix (commit d2715e3af) created RedirectDirHandler and positioned it in the handler chain so redirects respect security constraints. This fix was authored by upstream contributor Lin Gao and shipped in the upstream release 2.2.28.Final, which TuxCare later onboarded. The vulnerable pattern (redirects processed before security checks) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.23), NVD (< 2.0.23), cve.org (< 2.0.23.Final), Snyk (< 2.0.23.Final).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-5379",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.2.28.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b3520e9c-592f-585b-9424-9b99d9d66fd2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-5379 affects version 2.2.28.Final-tuxcare.1 of io.undertow:undertow-servlet."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/io.undertow/undertow-servlet@2.2.28.Final-tuxcare.1"
    }
  ]
}