{
  "@id": "urn:uuid:dbeb66ad-cdb9-4913-869d-53f2f05a1b98",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 28,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:07:59.808671+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.19-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.19-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:07:59.808671+00:00",
      "status_notes": "Vulnerability CVE-2020-27216 does not affect version 11.0.19-tuxcare.2 of org.eclipse.jetty:jetty-webapp. CVE-2020-27216 describes a race condition in temporary directory creation where Jetty used the insecure pattern File.createTempFile() + delete() + mkdir(), allowing attackers to win the race and control directories used for unpacking web applications. The target (Jetty 11.0.19) is NOT AFFECTED because the vulnerable code pattern has been replaced with the secure Files.createTempDirectory() API. This fix was authored by Joakim Erdfelt (joakim.erdfelt@gmail.com) in October 2020 (commit 53e0e0e9b25) and was included in upstream Jetty 11.0.0.beta3 and all subsequent 11.x releases, including 11.0.19. The fix was already present in the upstream release that TuxCare onboarded in January 2026.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.33.v20201020; >= 10.0.0.beta1, < 10.0.0.beta3; >= 11.0.0.beta1, < 11.0.0.beta3), NVD (>= 1.0, < 9.3.29; >= 9.4.0, <= 9.4.32; = 10.0.0-alpha1; = 10.0.0-beta0; = 10.0.0-beta1; = 10.0.0-beta2; = 11.0.0-alpha1; = 11.0.0-beta1; = 11.0.0-beta2), Snyk (>= 1.0, < 9.4.33.v20201020; >= 10.0.0.alpha1, < 10.0.0.beta3; >= 11.0.0.alpha1, < 11.0.0.beta3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27216"
      },
      "impact_statement": "CVE-2020-27216 describes a race condition in temporary directory creation where Jetty used the insecure pattern File.createTempFile() + delete() + mkdir(), allowing attackers to win the race and control directories used for unpacking web applications. The target (Jetty 11.0.19) is NOT AFFECTED because the vulnerable code pattern has been replaced with the secure Files.createTempDirectory() API. This fix was authored by Joakim Erdfelt (joakim.erdfelt@gmail.com) in October 2020 (commit 53e0e0e9b25) and was included in upstream Jetty 11.0.0.beta3 and all subsequent 11.x releases, including 11.0.19. The fix was already present in the upstream release that TuxCare onboarded in January 2026.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.33.v20201020; >= 10.0.0.beta1, < 10.0.0.beta3; >= 11.0.0.beta1, < 11.0.0.beta3), NVD (>= 1.0, < 9.3.29; >= 9.4.0, <= 9.4.32; = 10.0.0-alpha1; = 10.0.0-beta0; = 10.0.0-beta1; = 10.0.0-beta2; = 11.0.0-alpha1; = 11.0.0-beta1; = 11.0.0-beta2), Snyk (>= 1.0, < 9.4.33.v20201020; >= 10.0.0.alpha1, < 10.0.0.beta3; >= 11.0.0.alpha1, < 11.0.0.beta3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.19-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.19-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T03:46:18.861542+00:00",
      "status_notes": "Vulnerability CVE-2021-28164 does not affect version 11.0.19-tuxcare.2 of org.eclipse.jetty:jetty-webapp. not_affected \u2014 The target (Jetty 11.0.19-tuxcare.4) is not affected by CVE-2021-28164. The vulnerability allows percent-encoded dot characters in URIs (%2e, %2e%2e) to bypass path-based access controls and access protected resources like WEB-INF. The fix was introduced in upstream Jetty via commit 20ef71fe5d7 (Feb 2021) and subsequent refinements, included in Jetty 11.0.2+. This fix was already present in Jet...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28164"
      },
      "impact_statement": "not_affected \u2014 The target (Jetty 11.0.19-tuxcare.4) is not affected by CVE-2021-28164. The vulnerability allows percent-encoded dot characters in URIs (%2e, %2e%2e) to bypass path-based access controls and access protected resources like WEB-INF. The fix was introduced in upstream Jetty via commit 20ef71fe5d7 (Feb 2021) and subsequent refinements, included in Jetty 11.0.2+. This fix was already present in Jet..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.19-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.19-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T03:42:02.973774+00:00",
      "status_notes": "Vulnerability CVE-2021-34429 does not affect version 11.0.19-tuxcare.2 of org.eclipse.jetty:jetty-webapp. not_affected \u2014 CVE-2021-34429 affects Jetty versions before 9.4.43, 10.0.6, and 11.0.6. The target is Jetty 11.0.19-tuxcare.4, which is based on upstream Jetty 11.0.19 released after the fix. The vulnerability allows URI path traversal using encoded characters (%u002e, %00) to access protected directories like WEB-INF. All fix components are present: PathResource.addPath() rejects non-canonical paths, checkAl...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-34429"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-34429 affects Jetty versions before 9.4.43, 10.0.6, and 11.0.6. The target is Jetty 11.0.19-tuxcare.4, which is based on upstream Jetty 11.0.19 released after the fix. The vulnerability allows URI path traversal using encoded characters (%u002e, %00) to access protected directories like WEB-INF. All fix components are present: PathResource.addPath() rejects non-canonical paths, checkAl..."
    }
  ]
}