{
  "@id": "urn:uuid:b5c16e28-5fbd-4fb7-8cbc-7ab2dfb73d1f",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 16,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:07:59.808671+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:07:59.808671+00:00",
      "status_notes": "Vulnerability CVE-2020-27216 does not affect version 11.0.31.tuxcare0001 of org.eclipse.jetty:jetty-webapp. CVE-2020-27216: Temporary directory race condition vulnerability is NOT present in Jetty 11.0.31. The vulnerable pattern (File.createTempFile() + delete() + mkdirs()) was replaced with secure atomic directory creation using Files.createTempDirectory() in upstream commit 53e0e0e9b25, which shipped in Jetty 9.4.33.v20201020. This fix was already present in the upstream release that TuxCare onboarded at version 11.0.26. The current code at WebInfConfiguration.java:236 uses the secure method that creates directories atomically with proper permissions (0700 on Unix), eliminating the race window where an attacker could hijack the temp directory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.33.v20201020; >= 10.0.0.beta1, < 10.0.0.beta3; >= 11.0.0.beta1, < 11.0.0.beta3), NVD (>= 1.0, < 9.3.29; >= 9.4.0, <= 9.4.32; = 10.0.0-alpha1; = 10.0.0-beta0; = 10.0.0-beta1; = 10.0.0-beta2; = 11.0.0-alpha1; = 11.0.0-beta1; = 11.0.0-beta2), Snyk (>= 1.0, < 9.4.33.v20201020; >= 10.0.0.alpha1, < 10.0.0.beta3; >= 11.0.0.alpha1, < 11.0.0.beta3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27216"
      },
      "impact_statement": "CVE-2020-27216: Temporary directory race condition vulnerability is NOT present in Jetty 11.0.31. The vulnerable pattern (File.createTempFile() + delete() + mkdirs()) was replaced with secure atomic directory creation using Files.createTempDirectory() in upstream commit 53e0e0e9b25, which shipped in Jetty 9.4.33.v20201020. This fix was already present in the upstream release that TuxCare onboarded at version 11.0.26. The current code at WebInfConfiguration.java:236 uses the secure method that creates directories atomically with proper permissions (0700 on Unix), eliminating the race window where an attacker could hijack the temp directory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.33.v20201020; >= 10.0.0.beta1, < 10.0.0.beta3; >= 11.0.0.beta1, < 11.0.0.beta3), NVD (>= 1.0, < 9.3.29; >= 9.4.0, <= 9.4.32; = 10.0.0-alpha1; = 10.0.0-beta0; = 10.0.0-beta1; = 10.0.0-beta2; = 11.0.0-alpha1; = 11.0.0-beta1; = 11.0.0-beta2), Snyk (>= 1.0, < 9.4.33.v20201020; >= 10.0.0.alpha1, < 10.0.0.beta3; >= 11.0.0.alpha1, < 11.0.0.beta3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T03:51:10.253584+00:00",
      "status_notes": "Vulnerability CVE-2021-28164 does not affect version 11.0.31.tuxcare0001 of org.eclipse.jetty:jetty-webapp. not_affected \u2014 Jetty 11.0.31 is not affected by CVE-2021-28164. The vulnerability (path traversal via percent-encoded dots like %2e%2e to access protected WEB-INF directories) is not present because the target includes upstream security fixes that reject URIs with ambiguous path segments. The fix was introduced by upstream Jetty developers in commit e412c8a15b3334b30193f40412c0fbc47e478e83 (authored by gregw@...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28164"
      },
      "impact_statement": "not_affected \u2014 Jetty 11.0.31 is not affected by CVE-2021-28164. The vulnerability (path traversal via percent-encoded dots like %2e%2e to access protected WEB-INF directories) is not present because the target includes upstream security fixes that reject URIs with ambiguous path segments. The fix was introduced by upstream Jetty developers in commit e412c8a15b3334b30193f40412c0fbc47e478e83 (authored by gregw@..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.31.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.31.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T03:43:13.749002+00:00",
      "status_notes": "Vulnerability CVE-2021-34429 does not affect version 11.0.31.tuxcare0001 of org.eclipse.jetty:jetty-webapp. not_affected \u2014 CVE-2021-34429 is not present in Jetty 11.0.31.tuxcare0001. The vulnerability involved UTF-16 encoded URIs (e.g., %u002e) bypassing security constraints to access protected WEB-INF resources. The fix was shipped in upstream Jetty 11.0.6 (commit a3effb19c4e by lachlan@webtide.com) and is present in the target version. The fix introduced UriCompliance.java with UTF16_ENCODINGS violation detection...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-34429"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-34429 is not present in Jetty 11.0.31.tuxcare0001. The vulnerability involved UTF-16 encoded URIs (e.g., %u002e) bypassing security constraints to access protected WEB-INF resources. The fix was shipped in upstream Jetty 11.0.6 (commit a3effb19c4e by lachlan@webtide.com) and is present in the target version. The fix introduced UriCompliance.java with UTF16_ENCODINGS violation detection..."
    }
  ]
}