{
  "@id": "urn:uuid:e9140cb6-2bd1-4ea0-bc20-c0e57f5d2544",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T00:56:19.652549+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-deploy@10.0.26-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-deploy@10.0.26-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T00:56:19.652549+00:00",
      "status_notes": "Vulnerability CVE-2021-28163 does not affect version 10.0.26-tuxcare.4 of org.eclipse.jetty:jetty-deploy. not_affected \u2014 CVE-2021-28163 fix is present in the target repository. The vulnerability involved symlinks to monitored directories being deployed as web applications, exposing directory contents. The fix (commit 37fffb17226) implements Files.isSameFile() comparison in WebAppProvider.Filter.accept() to properly resolve symlinks when checking if a scanned entry matches a monitored directory. This fix was autho...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28163"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-28163 fix is present in the target repository. The vulnerability involved symlinks to monitored directories being deployed as web applications, exposing directory contents. The fix (commit 37fffb17226) implements Files.isSameFile() comparison in WebAppProvider.Filter.accept() to properly resolve symlinks when checking if a scanned entry matches a monitored directory. This fix was autho..."
    }
  ]
}