{
  "@id": "urn:uuid:6abccb00-1d55-416e-9352-2ca7f8d5626f",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 16,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:07:59.808671+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.29.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.29.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-11-04T09:07:59.808671+00:00",
      "status_notes": "Vulnerability CVE-2020-27216 does not affect version 11.0.29.tuxcare0004 of org.eclipse.jetty:jetty-webapp. CVE-2020-27216 describes a race condition vulnerability in temporary directory creation on Unix-like systems. The vulnerable pattern (File.createTempFile() \u2192 delete() \u2192 mkdirs()) allowed attackers to win a race and gain read/write access to web application temporary directories. The target repository uses the secure Files.createTempDirectory() method (lines 104, 236 in WebInfConfiguration.java), which atomically creates directories with secure permissions. The fix was applied by upstream Jetty developer Joakim Erdfelt in commit 53e0e0e9b25 (October 2020) and was already present in Jetty 11.0.26 when TuxCare onboarded this version branch. No instances of the vulnerable pattern exist in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.33.v20201020; >= 10.0.0.beta1, < 10.0.0.beta3; >= 11.0.0.beta1, < 11.0.0.beta3), NVD (>= 1.0, < 9.3.29; >= 9.4.0, <= 9.4.32; = 10.0.0-alpha1; = 10.0.0-beta0; = 10.0.0-beta1; = 10.0.0-beta2; = 11.0.0-alpha1; = 11.0.0-beta1; = 11.0.0-beta2), Snyk (>= 1.0, < 9.4.33.v20201020; >= 10.0.0.alpha1, < 10.0.0.beta3; >= 11.0.0.alpha1, < 11.0.0.beta3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27216"
      },
      "impact_statement": "CVE-2020-27216 describes a race condition vulnerability in temporary directory creation on Unix-like systems. The vulnerable pattern (File.createTempFile() \u2192 delete() \u2192 mkdirs()) allowed attackers to win a race and gain read/write access to web application temporary directories. The target repository uses the secure Files.createTempDirectory() method (lines 104, 236 in WebInfConfiguration.java), which atomically creates directories with secure permissions. The fix was applied by upstream Jetty developer Joakim Erdfelt in commit 53e0e0e9b25 (October 2020) and was already present in Jetty 11.0.26 when TuxCare onboarded this version branch. No instances of the vulnerable pattern exist in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.33.v20201020; >= 10.0.0.beta1, < 10.0.0.beta3; >= 11.0.0.beta1, < 11.0.0.beta3), NVD (>= 1.0, < 9.3.29; >= 9.4.0, <= 9.4.32; = 10.0.0-alpha1; = 10.0.0-beta0; = 10.0.0-beta1; = 10.0.0-beta2; = 11.0.0-alpha1; = 11.0.0-beta1; = 11.0.0-beta2), Snyk (>= 1.0, < 9.4.33.v20201020; >= 10.0.0.alpha1, < 10.0.0.beta3; >= 11.0.0.alpha1, < 11.0.0.beta3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.29.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.29.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-11-03T03:47:57.828343+00:00",
      "status_notes": "Vulnerability CVE-2021-28164 does not affect version 11.0.29.tuxcare0004 of org.eclipse.jetty:jetty-webapp. not_affected \u2014 CVE-2021-28164 is not present in Jetty 11.0.29. The vulnerability (path traversal via percent-encoded dots like %2e to access WEB-INF protected resources) was fixed by upstream commit 20ef71fe5d7 authored by gregw@webtide.com, which shipped in the upstream release 11.0.29 before TuxCare onboarded it. The fix adds ambiguous path segment detection in HttpURI.java and enforcement in Request.java. ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28164"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-28164 is not present in Jetty 11.0.29. The vulnerability (path traversal via percent-encoded dots like %2e to access WEB-INF protected resources) was fixed by upstream commit 20ef71fe5d7 authored by gregw@webtide.com, which shipped in the upstream release 11.0.29 before TuxCare onboarded it. The fix adds ambiguous path segment detection in HttpURI.java and enforcement in Request.java. ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.29.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.29.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-11-03T03:42:38.974178+00:00",
      "status_notes": "Vulnerability CVE-2021-34429 does not affect version 11.0.29.tuxcare0004 of org.eclipse.jetty:jetty-webapp. not_affected \u2014 CVE-2021-34429 affects Jetty versions prior to 9.4.43, 10.0.6, and 11.0.6. The target repository is Jetty 11.0.29 on a TuxCare branch. The vulnerability allows attackers to use encoded URI characters (%u002e for dots, %00 for null bytes) to access protected WEB-INF resources by bypassing path normalization. The fix commit f045b5a3bad055594d0d042beedd36bc50ad51b4 (Issue #6473) was authored by up...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-34429"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-34429 affects Jetty versions prior to 9.4.43, 10.0.6, and 11.0.6. The target repository is Jetty 11.0.29 on a TuxCare branch. The vulnerability allows attackers to use encoded URI characters (%u002e for dots, %00 for null bytes) to access protected WEB-INF resources by bypassing path normalization. The fix commit f045b5a3bad055594d0d042beedd36bc50ad51b4 (Issue #6473) was authored by up..."
    }
  ]
}