{
  "@id": "urn:uuid:96974488-ac8b-40f2-aced-dcbd9210430b",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 17,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T17:52:00.141527+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-deploy@11.0.27.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-deploy@11.0.27.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-11-02T17:52:00.141527+00:00",
      "status_notes": "Vulnerability CVE-2021-28163 does not affect version 11.0.27.tuxcare0004 of org.eclipse.jetty:jetty-deploy. not_affected \u2014 CVE-2021-28163 is not present in Jetty 11.0.27. The vulnerability, which allowed symlinked webapps directories to be deployed as static web applications exposing their contents, was fixed in upstream Jetty 11.0.10 (March 2021). The fix uses Files.isSameFile() via Resource.isSame() to properly resolve symlinks before comparing scanned paths against monitored directories. This prevents the webapp...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28163"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-28163 is not present in Jetty 11.0.27. The vulnerability, which allowed symlinked webapps directories to be deployed as static web applications exposing their contents, was fixed in upstream Jetty 11.0.10 (March 2021). The fix uses Files.isSameFile() via Resource.isSame() to properly resolve symlinks before comparing scanned paths against monitored directories. This prevents the webapp..."
    }
  ]
}