{
  "@id": "urn:uuid:8314709b-8318-438f-add5-b69684255523",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 38,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:03:00.104314+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@9.0.100-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@9.0.100-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-04T09:03:00.104314+00:00",
      "status_notes": "Vulnerability CVE-2016-5018 does not affect version 9.0.100-tuxcare.5 of org.apache.tomcat.embed:tomcat-embed-jasper. Apache Tomcat 9.0.100 is NOT affected by CVE-2016-5018. The vulnerability allowed malicious web applications to bypass a configured SecurityManager via the JspRuntimeLibrary.introspecthelper() method, which wrapped operations in AccessController.doPrivileged() to grant elevated privileges. This vulnerable code pattern (PrivilegedIntrospectHelper class and privileged execution wrapper) was removed by upstream Apache Tomcat in commit a6b1ebc246b91b854237e5aad3dfd2b5460ea282 by Mark Thomas on August 1, 2016. The fix was already present in the upstream release that TuxCare onboarded as version 9.0.100. The current code executes introspecthelper() with only the caller's permissions, preventing the SecurityManager bypass.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0RC1, < 8.0.37; >= 7.0.0, < 7.0.72; >= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0RC1, < 8.0.37; >= 7.0.0, < 7.0.72; >= 6.0.0, < 6.0.47), NVD (>= 6.0.0, <= 6.0.45; >= 7.0.0, <= 7.0.70; >= 8.0, <= 8.0.36; >= 8.5.0, <= 8.5.4; = 9.0.0-milestone1; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M9; >= 8.5.0, <= 8.5.4; >= 8.0.0.RC1, <= 8.0.36; >= 7.0.0, <= 7.0.70; >= 6.0.0, <= 6.0.45), Snyk (>= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5018"
      },
      "impact_statement": "Apache Tomcat 9.0.100 is NOT affected by CVE-2016-5018. The vulnerability allowed malicious web applications to bypass a configured SecurityManager via the JspRuntimeLibrary.introspecthelper() method, which wrapped operations in AccessController.doPrivileged() to grant elevated privileges. This vulnerable code pattern (PrivilegedIntrospectHelper class and privileged execution wrapper) was removed by upstream Apache Tomcat in commit a6b1ebc246b91b854237e5aad3dfd2b5460ea282 by Mark Thomas on August 1, 2016. The fix was already present in the upstream release that TuxCare onboarded as version 9.0.100. The current code executes introspecthelper() with only the caller's permissions, preventing the SecurityManager bypass.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0RC1, < 8.0.37; >= 7.0.0, < 7.0.72; >= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0RC1, < 8.0.37; >= 7.0.0, < 7.0.72; >= 6.0.0, < 6.0.47), NVD (>= 6.0.0, <= 6.0.45; >= 7.0.0, <= 7.0.70; >= 8.0, <= 8.0.36; >= 8.5.0, <= 8.5.4; = 9.0.0-milestone1; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M9; >= 8.5.0, <= 8.5.4; >= 8.0.0.RC1, <= 8.0.36; >= 7.0.0, <= 7.0.70; >= 6.0.0, <= 6.0.45), Snyk (>= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10)."
    }
  ]
}