{
  "@id": "urn:uuid:517d812a-ef0c-4052-a1b1-2472caf7a3f8",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 15,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T17:53:00.130920+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-deploy@9.4.62.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-deploy@9.4.62.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T17:53:00.130920+00:00",
      "status_notes": "Vulnerability CVE-2021-28163 does not affect version 9.4.62.tuxcare0001 of org.eclipse.jetty:jetty-deploy. not_affected \u2014 The target repository (Jetty 9.4.62) is NOT affected by CVE-2021-28163. The vulnerability was fixed in upstream commit 37fffb1722604da1763d8a096ec5c5fb41ea0633 (GHSA-j6qj-j888-vvgq) which was already present in the upstream release before TuxCare's onboarding. The fix prevents symlinked webapps directories from being deployed as static web applications by using Files.isSameFile() to detect when...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28163"
      },
      "impact_statement": "not_affected \u2014 The target repository (Jetty 9.4.62) is NOT affected by CVE-2021-28163. The vulnerability was fixed in upstream commit 37fffb1722604da1763d8a096ec5c5fb41ea0633 (GHSA-j6qj-j888-vvgq) which was already present in the upstream release before TuxCare's onboarding. The fix prevents symlinked webapps directories from being deployed as static web applications by using Files.isSameFile() to detect when..."
    }
  ]
}