{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:438ae0ec-47d0-5db3-b344-e6a1ad32a188",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "undertow-servlet",
      "purl": "pkg:maven/io.undertow/undertow-servlet@2.3.20.Final-tuxcare.3",
      "type": "library",
      "group": "io.undertow",
      "bom-ref": "pkg:maven/io.undertow/undertow-servlet@2.3.20.Final-tuxcare.3",
      "version": "2.3.20.Final-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "undertow-servlet",
            "purl": "pkg:maven/io.undertow/undertow-servlet@2.3.20.Final",
            "type": "library",
            "group": "io.undertow",
            "version": "2.3.20.Final"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2019-10184",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.20.Final-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:10b0d2cf-3850-50af-9ae0-e17e42f94274",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-10184 does not affect version 2.3.20.Final-tuxcare.3 of io.undertow:undertow-servlet. CVE-2019-10184 is NOT present in target version 2.3.20.Final-tuxcare.1. The vulnerability (information disclosure via redirect responses sent before authentication checks) was fixed in upstream commit d2715e3af by Lin Gao on 2019-07-24, which created RedirectDirHandler and repositioned redirect logic to run AFTER security handlers. This fix was already included in the upstream 2.3.20.Final release that TuxCare onboarded (commit 02d09c01a). The target's DeploymentManagerImpl correctly integrates RedirectDirHandler at line 224, positioned before security handler setup at line 226, ensuring authorization checks occur before any redirect responses that could reveal directory existence.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.23), NVD (< 2.0.23), cve.org (< 2.0.23.Final), Snyk (< 2.0.23.Final).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.20.Final-tuxcare.3"
    }
  ]
}