{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:1a6cad13-6157-509e-bf45-a1148cfaea66",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "undertow-servlet",
      "purl": "pkg:maven/io.undertow/undertow-servlet@2.2.37.Final-tuxcare.2",
      "type": "library",
      "group": "io.undertow",
      "bom-ref": "pkg:maven/io.undertow/undertow-servlet@2.2.37.Final-tuxcare.2",
      "version": "2.2.37.Final-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "undertow-servlet",
            "purl": "pkg:maven/io.undertow/undertow-servlet@2.2.37.Final",
            "type": "library",
            "group": "io.undertow",
            "version": "2.2.37.Final"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2019-10184",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.2.37.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:92a97cb0-7e23-5898-abfa-91d879c27154",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-10184 does not affect version 2.2.37.Final-tuxcare.2 of io.undertow:undertow-servlet. CVE-2019-10184 affects Undertow before version 2.0.23.Final. The target repository is version 2.2.37.Final, which includes the upstream fix committed by Lin Gao in d2715e3afa13f50deaa19643676816ce391551e9. The fix introduces RedirectDirHandler and reorders the handler chain so security checks execute before redirect logic, preventing unauthenticated information disclosure about directory structure. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.23), NVD (< 2.0.23), cve.org (< 2.0.23.Final), Snyk (< 2.0.23.Final).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/io.undertow/undertow-servlet@2.2.37.Final-tuxcare.2"
    }
  ]
}