{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:16ec4f12-778c-5c95-a127-2aaaa4629bd0",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "undertow-servlet",
      "purl": "pkg:maven/io.undertow/undertow-servlet@2.2.7.Final-tuxcare.1",
      "type": "library",
      "group": "io.undertow",
      "bom-ref": "pkg:maven/io.undertow/undertow-servlet@2.2.7.Final-tuxcare.1",
      "version": "2.2.7.Final-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "undertow-servlet",
            "purl": "pkg:maven/io.undertow/undertow-servlet@2.2.7.Final",
            "type": "library",
            "group": "io.undertow",
            "version": "2.2.7.Final"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2019-10184",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.2.7.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:6b72d8e8-f28d-5a62-b007-d8c5da604ce6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-10184 does not affect version 2.2.7.Final-tuxcare.1 of io.undertow:undertow-servlet. CVE-2019-10184: Target is NOT AFFECTED. The vulnerability (information disclosure through redirect responses to protected directories without trailing slashes) was fixed in upstream Undertow 2.2.7.Final before TuxCare onboarded this version. The fix repositioned redirect-handling logic (RedirectDirHandler) to execute after authentication checks, preventing unauthorized disclosure of directory existence. Fix commit d2715e3af by Lin Gao was already present in the upstream release that TuxCare imported.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.23), NVD (< 2.0.23), cve.org (< 2.0.23.Final), Snyk (< 2.0.23.Final).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-1259",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.2.7.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e297caa8-5dd9-530b-a746-fa419974aa87",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-1259 affects version 2.2.7.Final-tuxcare.1 of io.undertow:undertow-servlet."
      }
    },
    {
      "id": "CVE-2022-1319",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.2.7.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:bcbf35f5-0a5f-5e73-ac03-5944f028166c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-1319 affects version 2.2.7.Final-tuxcare.1 of io.undertow:undertow-servlet."
      }
    },
    {
      "id": "CVE-2022-2764",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.2.7.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e7937fd4-5817-5ddd-a071-5e768244de7d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-2764 affects version 2.2.7.Final-tuxcare.1 of io.undertow:undertow-servlet."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/io.undertow/undertow-servlet@2.2.7.Final-tuxcare.1"
    }
  ]
}