{
  "@id": "urn:uuid:8b42086c-b6ed-4c31-8f6e-9239cb59ed48",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T15:11:05.515662+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.62.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.62.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-11-09T15:11:05.515662+00:00",
      "status_notes": "Vulnerability CVE-2020-27216 affects version 9.4.62.tuxcare0003 of org.eclipse.jetty:jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2020-27216"
      },
      "action_statement": "Vulnerability CVE-2020-27216 affects version 9.4.62.tuxcare0003 of org.eclipse.jetty:jetty-webapp."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.62.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.62.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-11-09T15:11:05.515662+00:00",
      "status_notes": "Vulnerability CVE-2021-28164 does not affect version 9.4.62.tuxcare0003 of org.eclipse.jetty:jetty-webapp. not_affected \u2014 CVE-2021-28164: Target is NOT AFFECTED. The vulnerability allows path traversal to WEB-INF via percent-encoded dots (e.g., /%2e/WEB-INF/web.xml). The upstream fix (commit f045b5a3bad, June 2021) is present in the target's 9.4.62 base release. This fix changed HttpURI to decode-then-canonicalize paths, ensuring /%2e sequences are properly normalized to prevent directory traversal. While the spec...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28164"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-28164: Target is NOT AFFECTED. The vulnerability allows path traversal to WEB-INF via percent-encoded dots (e.g., /%2e/WEB-INF/web.xml). The upstream fix (commit f045b5a3bad, June 2021) is present in the target's 9.4.62 base release. This fix changed HttpURI to decode-then-canonicalize paths, ensuring /%2e sequences are properly normalized to prevent directory traversal. While the spec..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.62.tuxcare0003",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.62.tuxcare0003"
          }
        }
      ],
      "timestamp": "2026-11-09T15:11:05.515662+00:00",
      "status_notes": "Vulnerability CVE-2021-34429 does not affect version 9.4.62.tuxcare0003 of org.eclipse.jetty:jetty-webapp. not_affected \u2014 CVE-2021-34429 affects Jetty versions prior to 9.4.43. The target version 9.4.62 is not vulnerable because the fix was included in upstream release 9.4.43 (June 2021), which predates the TuxCare onboarding of version 9.4.58.1. All required defenses are present: null byte rejection in HttpURI (line 706), decode-then-normalize logic (lines 868-869), canonicalization checks in PathResource.addPath...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-34429"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-34429 affects Jetty versions prior to 9.4.43. The target version 9.4.62 is not vulnerable because the fix was included in upstream release 9.4.43 (June 2021), which predates the TuxCare onboarding of version 9.4.58.1. All required defenses are present: null byte rejection in HttpURI (line 706), decode-then-normalize logic (lines 868-869), canonicalization checks in PathResource.addPath..."
    }
  ]
}