{
  "@id": "urn:uuid:2799c422-194f-44e4-8d33-c622a527410e",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 16,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:07:59.808671+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:07:59.808671+00:00",
      "status_notes": "Vulnerability CVE-2020-27216 does not affect version 11.0.32.tuxcare0001 of org.eclipse.jetty:jetty-webapp. CVE-2020-27216 does not affect Jetty 11.0.32. The vulnerable temporary directory creation pattern (File.createTempFile \u2192 delete \u2192 mkdir race condition) is not present in the target. The code uses the secure Files.createTempDirectory() API (lines 104, 242 in WebInfConfiguration.java) which creates directories atomically with proper permissions, eliminating the race condition. This fix was authored by upstream Jetty developer Joakim Erdfelt and shipped in upstream release 11.0.0.beta3 (per CVE advisory), well before TuxCare onboarded version 11.0.26.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.33.v20201020; >= 10.0.0.beta1, < 10.0.0.beta3; >= 11.0.0.beta1, < 11.0.0.beta3), NVD (>= 1.0, < 9.3.29; >= 9.4.0, <= 9.4.32; = 10.0.0-alpha1; = 10.0.0-beta0; = 10.0.0-beta1; = 10.0.0-beta2; = 11.0.0-alpha1; = 11.0.0-beta1; = 11.0.0-beta2), Snyk (>= 1.0, < 9.4.33.v20201020; >= 10.0.0.alpha1, < 10.0.0.beta3; >= 11.0.0.alpha1, < 11.0.0.beta3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27216"
      },
      "impact_statement": "CVE-2020-27216 does not affect Jetty 11.0.32. The vulnerable temporary directory creation pattern (File.createTempFile \u2192 delete \u2192 mkdir race condition) is not present in the target. The code uses the secure Files.createTempDirectory() API (lines 104, 242 in WebInfConfiguration.java) which creates directories atomically with proper permissions, eliminating the race condition. This fix was authored by upstream Jetty developer Joakim Erdfelt and shipped in upstream release 11.0.0.beta3 (per CVE advisory), well before TuxCare onboarded version 11.0.26.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.33.v20201020; >= 10.0.0.beta1, < 10.0.0.beta3; >= 11.0.0.beta1, < 11.0.0.beta3), NVD (>= 1.0, < 9.3.29; >= 9.4.0, <= 9.4.32; = 10.0.0-alpha1; = 10.0.0-beta0; = 10.0.0-beta1; = 10.0.0-beta2; = 11.0.0-alpha1; = 11.0.0-beta1; = 11.0.0-beta2), Snyk (>= 1.0, < 9.4.33.v20201020; >= 10.0.0.alpha1, < 10.0.0.beta3; >= 11.0.0.alpha1, < 11.0.0.beta3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T03:52:34.610870+00:00",
      "status_notes": "Vulnerability CVE-2021-28164 does not affect version 11.0.32.tuxcare0001 of org.eclipse.jetty:jetty-webapp. not_affected \u2014 Target is NOT vulnerable to CVE-2021-28164. The fix for ambiguous URI path segment normalization was already present in upstream Jetty 11.0.26, which TuxCare onboarded. The vulnerable pattern (percent-encoded dot segments like %2e bypassing WEB-INF protection) is not present because HttpURI.getDecodedPath() unconditionally normalizes all decoded paths via URIUtil.canonicalPath(), preventing exp...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28164"
      },
      "impact_statement": "not_affected \u2014 Target is NOT vulnerable to CVE-2021-28164. The fix for ambiguous URI path segment normalization was already present in upstream Jetty 11.0.26, which TuxCare onboarded. The vulnerable pattern (percent-encoded dot segments like %2e bypassing WEB-INF protection) is not present because HttpURI.getDecodedPath() unconditionally normalizes all decoded paths via URIUtil.canonicalPath(), preventing exp..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T03:43:55.008598+00:00",
      "status_notes": "Vulnerability CVE-2021-34429 does not affect version 11.0.32.tuxcare0001 of org.eclipse.jetty:jetty-webapp. not_affected \u2014 CVE-2021-34429 affects Jetty versions that allow URIs with encoded characters (like %u002e, %00) to bypass security constraints and access protected resources like WEB-INF. The target repository (Jetty 11.0.32.tuxcare0001) contains the upstream fix commit f045b5a3bad authored by Simone Bordet, which was already present in the Jetty 11.0.26 release that TuxCare onboarded. The fix implements mult...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-34429"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-34429 affects Jetty versions that allow URIs with encoded characters (like %u002e, %00) to bypass security constraints and access protected resources like WEB-INF. The target repository (Jetty 11.0.32.tuxcare0001) contains the upstream fix commit f045b5a3bad authored by Simone Bordet, which was already present in the Jetty 11.0.26 release that TuxCare onboarded. The fix implements mult..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-12611 is fixed in version 11.0.32.tuxcare0001 of org.eclipse.jetty:jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2026-12611"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-19203 is fixed in version 11.0.32.tuxcare0001 of org.eclipse.jetty:jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2026-19203"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.32.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.32.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-19204 is fixed in version 11.0.32.tuxcare0001 of org.eclipse.jetty:jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2026-19204"
      }
    }
  ]
}