{
  "@id": "urn:uuid:380e58c3-bfec-405e-9993-9e3c5f030dd5",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 5,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T16:29:48.390816+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T16:54:19.808953+00:00",
      "status_notes": "Vulnerability CVE-2020-27216 does not affect version 10.0.34.tuxcare0001 of org.eclipse.jetty:jetty-webapp. Version 10.0.29 is not vulnerable. Summary: CVE-2020-27216 has been fixed in this repository. The target is running Jetty 10.0.29, which is well after the affected version range (10.0.0.alpha1 through 10.0.0.beta2). The vulnerable temporary directory creation pattern using File.createTempFile() followed by delete() and mkdirs() has been replaced with the secure Files.createTempDirectory() method, which provides atomic creation with restrictive permissions (0700 on Unix). [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27216"
      },
      "impact_statement": "Version 10.0.29 is not vulnerable. Summary: CVE-2020-27216 has been fixed in this repository. The target is running Jetty 10.0.29, which is well after the affected version range (10.0.0.alpha1 through 10.0.0.beta2). The vulnerable temporary directory creation pattern using File.createTempFile() followed by delete() and mkdirs() has been replaced with the secure Files.createTempDirectory() method, which provides atomic creation with restrictive permissions (0700 on Unix). [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T14:59:04.617737+00:00",
      "status_notes": "Vulnerability CVE-2021-28164 does not affect version 10.0.34.tuxcare0001 of org.eclipse.jetty:jetty-webapp. not_affected \u2014 CVE-2021-28164 is NOT present in the target (Jetty 10.0.34.tuxcare0001). The vulnerability allowed path traversal via percent-encoded dots (%2e, %2e%2e) to access protected resources like WEB-INF. The upstream fix was already included in the Jetty 10.0.26+ release that TuxCare onboarded. The fix comprises: (1) detection of ambiguous path segments during URI parsing, (2) rejection by default via...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28164"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-28164 is NOT present in the target (Jetty 10.0.34.tuxcare0001). The vulnerability allowed path traversal via percent-encoded dots (%2e, %2e%2e) to access protected resources like WEB-INF. The upstream fix was already included in the Jetty 10.0.26+ release that TuxCare onboarded. The fix comprises: (1) detection of ambiguous path segments during URI parsing, (2) rejection by default via..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T15:19:43.444136+00:00",
      "status_notes": "Vulnerability CVE-2021-34429 does not affect version 10.0.34.tuxcare0001 of org.eclipse.jetty:jetty-webapp. not_affected \u2014 CVE-2021-34429 (path traversal via encoded URI segments) is NOT present in this target. The vulnerability allowed attackers to use encoded characters like %u002e (UTF-16 encoded dot) or %00 (null byte) to access protected directories such as WEB-INF. The upstream fix (commit 3c32afa05c5 by lachlan@webtide.com) was already present in the Jetty 10.0.26 release that TuxCare onboarded, predating al...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-34429"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-34429 (path traversal via encoded URI segments) is NOT present in this target. The vulnerability allowed attackers to use encoded characters like %u002e (UTF-16 encoded dot) or %00 (null byte) to access protected directories such as WEB-INF. The upstream fix (commit 3c32afa05c5 by lachlan@webtide.com) was already present in the Jetty 10.0.26 release that TuxCare onboarded, predating al..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T16:54:19.808953+00:00",
      "status_notes": "Vulnerability CVE-2026-12611 is fixed in version 10.0.34.tuxcare0001 of org.eclipse.jetty:jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2026-12611"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T16:54:19.808953+00:00",
      "status_notes": "Vulnerability CVE-2026-19203 is fixed in version 10.0.34.tuxcare0001 of org.eclipse.jetty:jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2026-19203"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T16:54:19.808953+00:00",
      "status_notes": "Vulnerability CVE-2026-19204 is fixed in version 10.0.34.tuxcare0001 of org.eclipse.jetty:jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2026-19204"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T16:54:19.808953+00:00",
      "status_notes": "Vulnerability CVE-2026-76182 is fixed in version 10.0.34.tuxcare0001 of org.eclipse.jetty:jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2026-76182"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T16:54:19.808953+00:00",
      "status_notes": "Vulnerability CVE-2026-76184 is fixed in version 10.0.34.tuxcare0001 of org.eclipse.jetty:jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2026-76184"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T16:54:19.808953+00:00",
      "status_notes": "Vulnerability CVE-2026-77711 is fixed in version 10.0.34.tuxcare0001 of org.eclipse.jetty:jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2026-77711"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T16:55:00.224632+00:00",
      "status_notes": "Vulnerability CVE-2026-95533 is fixed in version 10.0.34.tuxcare0001 of org.eclipse.jetty:jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2026-95533"
      }
    }
  ]
}