{
  "@id": "urn:uuid:a0ab8128-90e6-48b3-b62b-e19619030b94",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 15,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T17:53:00.130920+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-deploy@10.0.28.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-deploy@10.0.28.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-02T17:53:00.130920+00:00",
      "status_notes": "Vulnerability CVE-2021-28163 does not affect version 10.0.28.tuxcare0002 of org.eclipse.jetty:jetty-deploy. not_affected \u2014 CVE-2021-28163 (symlink deployment vulnerability) is NOT present in target jetty-project 10.0.28.tuxcare0003. The upstream fix (commit 37fffb17226) was already included in Jetty 10.0.26, which predates TuxCare's onboarding at cf975b23e. The fix uses Files.isSameFile() via Resource.isSame() to properly compare filesystem paths accounting for symbolic links, preventing the monitored webapps direc...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28163"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-28163 (symlink deployment vulnerability) is NOT present in target jetty-project 10.0.28.tuxcare0003. The upstream fix (commit 37fffb17226) was already included in Jetty 10.0.26, which predates TuxCare's onboarding at cf975b23e. The fix uses Files.isSameFile() via Resource.isSame() to properly compare filesystem paths accounting for symbolic links, preventing the monitored webapps direc..."
    }
  ]
}