{
  "@id": "urn:uuid:d73f2fec-3341-4c34-8642-2397ca790d30",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 14,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T17:53:00.130920+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-deploy@10.0.30.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-deploy@10.0.30.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T17:53:00.130920+00:00",
      "status_notes": "Vulnerability CVE-2021-28163 does not affect version 10.0.30.tuxcare0001 of org.eclipse.jetty:jetty-deploy. not_affected \u2014 CVE-2021-28163 is not present in Jetty 10.0.30. The vulnerability involved symlinks in ${jetty.base}/webapps being deployed as static web applications, exposing directory contents. The vendor fix uses Files.isSameFile() to properly resolve symlinks before comparing resources. This fix (commit c1ae922ab051f) was authored by upstream contributor Greg Wilkins and was already present in the upstrea...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28163"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-28163 is not present in Jetty 10.0.30. The vulnerability involved symlinks in ${jetty.base}/webapps being deployed as static web applications, exposing directory contents. The vendor fix uses Files.isSameFile() to properly resolve symlinks before comparing resources. This fix (commit c1ae922ab051f) was authored by upstream contributor Greg Wilkins and was already present in the upstrea..."
    }
  ]
}