{
  "@id": "urn:uuid:dcfedc01-fb37-4efc-b2e3-c54852038616",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 15,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T03:49:12.045760+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-27216 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty:jetty-webapp. Version 10.0.29 is not vulnerable. Summary: CVE-2020-27216 has been fixed in this repository. The target is running Jetty 10.0.29, which is well after the affected version range (10.0.0.alpha1 through 10.0.0.beta2). The vulnerable temporary directory creation pattern using File.createTempFile() followed by delete() and mkdirs() has been replaced with the secure Files.createTempDirectory() method, which provides atomic creation with restrictive permissions (0700 on Unix). [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27216"
      },
      "impact_statement": "Version 10.0.29 is not vulnerable. Summary: CVE-2020-27216 has been fixed in this repository. The target is running Jetty 10.0.29, which is well after the affected version range (10.0.0.alpha1 through 10.0.0.beta2). The vulnerable temporary directory creation pattern using File.createTempFile() followed by delete() and mkdirs() has been replaced with the secure Files.createTempDirectory() method, which provides atomic creation with restrictive permissions (0700 on Unix). [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T03:49:12.045760+00:00",
      "status_notes": "Vulnerability CVE-2021-28164 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty:jetty-webapp. not_affected \u2014 CVE-2021-28164 is NOT present in Jetty 10.0.31. The vulnerability allowed URIs with percent-encoded dot segments (e.g., %2e, %2e%2e) to bypass path normalization and access protected resources like /WEB-INF/web.xml. The upstream fix (commit 20ef71fe5d7 by gregw@webtide.com) added comprehensive detection of ambiguous URI segments and enforcement via UriCompliance modes. The fix was already inclu...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28164"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-28164 is NOT present in Jetty 10.0.31. The vulnerability allowed URIs with percent-encoded dot segments (e.g., %2e, %2e%2e) to bypass path normalization and access protected resources like /WEB-INF/web.xml. The upstream fix (commit 20ef71fe5d7 by gregw@webtide.com) added comprehensive detection of ambiguous URI segments and enforcement via UriCompliance modes. The fix was already inclu..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T03:43:55.008598+00:00",
      "status_notes": "Vulnerability CVE-2021-34429 does not affect version 10.0.31.tuxcare0001 of org.eclipse.jetty:jetty-webapp. not_affected \u2014 CVE-2021-34429 is not present in Jetty 10.0.31.tuxcare0001. The vulnerability involved encoded URI segments (%u002e, %00) bypassing normalization to access WEB-INF directories. The upstream fix (commit f045b5a3bad by Simone Bordet) was already included in Jetty 10.0.26, which TuxCare onboarded. The target contains comprehensive defenses: (1) HttpURI decodes then normalizes URIs, preventing re-n...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-34429"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-34429 is not present in Jetty 10.0.31.tuxcare0001. The vulnerability involved encoded URI segments (%u002e, %00) bypassing normalization to access WEB-INF directories. The upstream fix (commit f045b5a3bad by Simone Bordet) was already included in Jetty 10.0.26, which TuxCare onboarded. The target contains comprehensive defenses: (1) HttpURI decodes then normalizes URIs, preventing re-n..."
    }
  ]
}