{
  "@id": "urn:uuid:ed3f767c-e97f-4f9f-a8a0-0b89a2eacac1",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:03:00.104314+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@9.0.50-tuxcare.17",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@9.0.50-tuxcare.17"
          }
        }
      ],
      "timestamp": "2026-11-04T09:03:00.104314+00:00",
      "status_notes": "Vulnerability CVE-2016-5018 does not affect version 9.0.50-tuxcare.17 of org.apache.tomcat.embed:tomcat-embed-jasper. The target repository (Apache Tomcat 9.0.50) does not contain the CVE-2016-5018 vulnerability. The vulnerable code pattern \u2014 a public `introspecthelper` method that wrapped its operations in `AccessController.doPrivileged()`, allowing web applications to bypass SecurityManager restrictions \u2014 was removed by upstream Apache in August 2016 (commit a6b1ebc246b91b854237e5aad3dfd2b5460ea282). This fix was already present in the upstream Tomcat release when TuxCare onboarded version 9.0.50. The target version is much newer than the affected range (9.0.0.M1 to 9.0.0.M9) and lacks all vulnerable components: no PrivilegedIntrospectHelper inner class, no doPrivileged() wrapper, no IS_SECURITY_ENABLED check.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0RC1, < 8.0.37; >= 7.0.0, < 7.0.72; >= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0RC1, < 8.0.37; >= 7.0.0, < 7.0.72; >= 6.0.0, < 6.0.47), NVD (>= 6.0.0, <= 6.0.45; >= 7.0.0, <= 7.0.70; >= 8.0, <= 8.0.36; >= 8.5.0, <= 8.5.4; = 9.0.0-milestone1; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M9; >= 8.5.0, <= 8.5.4; >= 8.0.0.RC1, <= 8.0.36; >= 7.0.0, <= 7.0.70; >= 6.0.0, <= 6.0.45), Snyk (>= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5018"
      },
      "impact_statement": "The target repository (Apache Tomcat 9.0.50) does not contain the CVE-2016-5018 vulnerability. The vulnerable code pattern \u2014 a public `introspecthelper` method that wrapped its operations in `AccessController.doPrivileged()`, allowing web applications to bypass SecurityManager restrictions \u2014 was removed by upstream Apache in August 2016 (commit a6b1ebc246b91b854237e5aad3dfd2b5460ea282). This fix was already present in the upstream Tomcat release when TuxCare onboarded version 9.0.50. The target version is much newer than the affected range (9.0.0.M1 to 9.0.0.M9) and lacks all vulnerable components: no PrivilegedIntrospectHelper inner class, no doPrivileged() wrapper, no IS_SECURITY_ENABLED check.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0RC1, < 8.0.37; >= 7.0.0, < 7.0.72; >= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0RC1, < 8.0.37; >= 7.0.0, < 7.0.72; >= 6.0.0, < 6.0.47), NVD (>= 6.0.0, <= 6.0.45; >= 7.0.0, <= 7.0.70; >= 8.0, <= 8.0.36; >= 8.5.0, <= 8.5.4; = 9.0.0-milestone1; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M9; >= 8.5.0, <= 8.5.4; >= 8.0.0.RC1, <= 8.0.36; >= 7.0.0, <= 7.0.70; >= 6.0.0, <= 6.0.45), Snyk (>= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10)."
    }
  ]
}