{
  "@id": "urn:uuid:759c9f12-2b22-4bea-b363-7d8b49198d0a",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 17,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:07:59.808671+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.30.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.30.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-04T09:07:59.808671+00:00",
      "status_notes": "Vulnerability CVE-2020-27216 does not affect version 11.0.30.tuxcare0002 of org.eclipse.jetty:jetty-webapp. The target (Jetty 11.0.30 at SHA bfe95d9da61) is NOT AFFECTED by CVE-2020-27216. The vulnerable race-condition pattern (File.createTempFile \u2192 delete \u2192 mkdirs) has been replaced with secure atomic directory creation (Files.createTempDirectory) at both vulnerable locations: cloneConfigure (line 104) and makeTempDirectory (line 236). The fix was authored by upstream developer Joakim Erdfelt in commit 53e0e0e9b25 (Oct 15, 2020) and was already present in the upstream release that TuxCare onboarded (first TuxCare commit 550492a850a from Dec 12, 2025). No vulnerable code paths remain in production code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.33.v20201020; >= 10.0.0.beta1, < 10.0.0.beta3; >= 11.0.0.beta1, < 11.0.0.beta3), NVD (>= 1.0, < 9.3.29; >= 9.4.0, <= 9.4.32; = 10.0.0-alpha1; = 10.0.0-beta0; = 10.0.0-beta1; = 10.0.0-beta2; = 11.0.0-alpha1; = 11.0.0-beta1; = 11.0.0-beta2), Snyk (>= 1.0, < 9.4.33.v20201020; >= 10.0.0.alpha1, < 10.0.0.beta3; >= 11.0.0.alpha1, < 11.0.0.beta3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27216"
      },
      "impact_statement": "The target (Jetty 11.0.30 at SHA bfe95d9da61) is NOT AFFECTED by CVE-2020-27216. The vulnerable race-condition pattern (File.createTempFile \u2192 delete \u2192 mkdirs) has been replaced with secure atomic directory creation (Files.createTempDirectory) at both vulnerable locations: cloneConfigure (line 104) and makeTempDirectory (line 236). The fix was authored by upstream developer Joakim Erdfelt in commit 53e0e0e9b25 (Oct 15, 2020) and was already present in the upstream release that TuxCare onboarded (first TuxCare commit 550492a850a from Dec 12, 2025). No vulnerable code paths remain in production code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.33.v20201020; >= 10.0.0.beta1, < 10.0.0.beta3; >= 11.0.0.beta1, < 11.0.0.beta3), NVD (>= 1.0, < 9.3.29; >= 9.4.0, <= 9.4.32; = 10.0.0-alpha1; = 10.0.0-beta0; = 10.0.0-beta1; = 10.0.0-beta2; = 11.0.0-alpha1; = 11.0.0-beta1; = 11.0.0-beta2), Snyk (>= 1.0, < 9.4.33.v20201020; >= 10.0.0.alpha1, < 10.0.0.beta3; >= 11.0.0.alpha1, < 11.0.0.beta3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.30.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.30.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-03T03:51:39.004857+00:00",
      "status_notes": "Vulnerability CVE-2021-28164 does not affect version 11.0.30.tuxcare0002 of org.eclipse.jetty:jetty-webapp. not_affected \u2014 Target version 11.0.30 is not affected by CVE-2021-28164. The upstream vendor's fix (commit e412c8a15b3) was already present in the upstream release that TuxCare onboarded (version 11.0.26, commit 550492a850a). The fix implements comprehensive defense: (1) HttpURI detects percent-encoded dot segments (%2e, %2e%2e) and flags them as AMBIGUOUS_PATH_SEGMENT violations; (2) UriCompliance.DEFAULT (t...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28164"
      },
      "impact_statement": "not_affected \u2014 Target version 11.0.30 is not affected by CVE-2021-28164. The upstream vendor's fix (commit e412c8a15b3) was already present in the upstream release that TuxCare onboarded (version 11.0.26, commit 550492a850a). The fix implements comprehensive defense: (1) HttpURI detects percent-encoded dot segments (%2e, %2e%2e) and flags them as AMBIGUOUS_PATH_SEGMENT violations; (2) UriCompliance.DEFAULT (t..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.30.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.30.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-03T03:43:13.749002+00:00",
      "status_notes": "Vulnerability CVE-2021-34429 does not affect version 11.0.30.tuxcare0002 of org.eclipse.jetty:jetty-webapp. not_affected \u2014 CVE-2021-34429 fix is present in the target. The vulnerability allowed encoded characters (%u002e, %00) to bypass normalization and access protected WEB-INF resources. The upstream fix (commit f045b5a3bad, issue #6473) shipped in Jetty 11.0.x before TuxCare onboarded version 11.0.26. All defenses are verified: (1) HttpURI rejects null bytes at line 1323-1326, (2) decode-then-canonicalize order ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-34429"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-34429 fix is present in the target. The vulnerability allowed encoded characters (%u002e, %00) to bypass normalization and access protected WEB-INF resources. The upstream fix (commit f045b5a3bad, issue #6473) shipped in Jetty 11.0.x before TuxCare onboarded version 11.0.26. All defenses are verified: (1) HttpURI rejects null bytes at line 1323-1326, (2) decode-then-canonicalize order ..."
    }
  ]
}