{
  "@id": "urn:uuid:20ca8e79-bd0b-46f2-9f53-9b93523bea8a",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 14,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T17:53:00.130920+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-deploy@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-deploy@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T17:53:00.130920+00:00",
      "status_notes": "Vulnerability CVE-2021-28163 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty:jetty-deploy. not_affected \u2014 CVE-2021-28163 is not present in this target. The vulnerability, which allowed symlinked webapps directories to be deployed as static web applications exposing their contents, was fixed in the upstream Jetty release that TuxCare onboarded. The fix (commit 37fffb17226) implements symlink-aware path comparison using Files.isSameFile() in WebAppProvider.Filter.accept() to properly identify when a ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28163"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-28163 is not present in this target. The vulnerability, which allowed symlinked webapps directories to be deployed as static web applications exposing their contents, was fixed in the upstream Jetty release that TuxCare onboarded. The fix (commit 37fffb17226) implements symlink-aware path comparison using Files.isSameFile() in WebAppProvider.Filter.accept() to properly identify when a ..."
    }
  ]
}