{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:9706ede7-c8f4-54c1-9538-6d8330591297", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "karaf", "purl": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.1", "type": "library", "group": "io.undertow", "bom-ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.1", "version": "1.4.27.Final-tuxcare.1", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2017-12196", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:45d1c8a9-be05-506e-8a4d-23c263d59b03", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12196 does not affect version 1.4.27.Final-tuxcare.1 of io.undertow:karaf. not_affected \u2014 CVE-2017-12196 is an Undertow Digest-auth flaw: the server failed to verify that the \"digest-uri\" value inside the Authorization header matches the actual HTTP request-line URI, enabling a MITM/credential-reuse attack (a captured Digest credential could be redirected to a different resource). Fixed upstream in 1.4.24.Final (UNDERTOW-1190). The target is undertow 1.4.27.Final (tuxcare.1 backport), which is AFTER the fix version. Direct code inspection confirms the fix is present: DigestAuthenticationMechanism.handleDigestHeader() (core/.../security/impl/DigestAuthenticationMechanism.java:233-257) compares the Authorization \"digest-uri\" token against the reconstructed request URI (path + \"?\" + query) and, as an enhancement, against the absolute request URL; on mismatch it sets 400 BAD_REQUEST and ends the exchange without authenticating, and if the DIGEST_URI token is absent it returns NOT_AUTHENTICATED. The check is on the sole Digest execution path (authenticate() -> handleDigestHeader(), line 167) and precedes credential (H(A2)) validation, with no bypass. git blame attributes lines 233-239 to upstream commit c916239d and lines 240-254 to upstream commit 11b6f0e0, both by Stuart Douglas (stuart.w.douglas@gmail.com). Both commits are ancestors of the plain upstream 1.4.27.Final commit, so the fix shipped upstream before TuxCare onboarding. Verdict: not_affected (upstream fix already present; not a TuxCare backport, so not \"already_fixed\"). [VC re-run with claude-opus-4-8, prod prompt pin d46bd7a, 2026-09-16; Sonnet run failed the author gate (A2 onboarding-merge overclaim); applied manually after git verification]", "justification": "code_not_present" } }, { "id": "CVE-2018-1114", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:b03be720-151f-5531-95f1-ccfab29b51d4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1114 does not affect version 1.4.27.Final-tuxcare.1 of io.undertow:karaf. not_affected \u2014 Target is Undertow 1.4.27.Final (undertow-io/undertow) \u2014 correct product, not a false positive. CVE-2018-1114 is the file-descriptor leak where URLResource.getLastModified()/getContentLength() opened a URLConnection but closed the underlying stream only at GC finalization, exhausting file descriptors (DoS). The complete upstream fix is already present in the shipped 1.4.27.Final source. URLResource.openConnection() (core/.../resource/URLResource.java:80-110) closes the connection's input stream promptly in a finally block (IoUtils.safeClose(connection.getInputStream()), lines 100-108) and, for jar: URLs, disables caching and reads the timestamp from the underlying jar file directly (setUseCaches(false) + File.lastModified(), lines 92-98) \u2014 exactly the change in the provided patch commits 882d5884/7f22aa0090. git blame attributes these lines to upstream commits 87f4fb41fc (UNDERTOW-1081, 2017-05-24) and 7f22aa0090 (UNDERTOW-1338, 2018-04-24), both ancestors of HEAD, both predating the 1.4.27.Final release. The vulnerable close-on-finalization pattern is therefore absent from HEAD. The fix is upstream-authored (stuart.w.douglas@gmail.com / norito.agetsuma@gmail.com), NOT a TuxCare/CloudLinux backport, and URLResource.java was not modified after onboarding \u2014 so verdict is not_affected (vendor fix already shipped), justification code_not_present. [VC re-run with claude-opus-4-8, prod prompt pin d46bd7a, 2026-09-16; Sonnet run failed the author gate (A2 onboarding-merge overclaim); applied manually after git verification]", "justification": "code_not_present" } }, { "id": "CVE-2018-14642", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:e63ca1fd-b3ed-56df-8dbe-d263e3267c7d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-14642 affects version 1.4.27.Final-tuxcare.1 of io.undertow:karaf." } }, { "id": "CVE-2019-10184", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:bdf181bd-974d-530d-9c6c-cec91fa58fd8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10184 affects version 1.4.27.Final-tuxcare.1 of io.undertow:karaf." } }, { "id": "CVE-2019-10212", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:501b92e5-6216-5a52-9092-b23e2f8c2ddf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10212 affects version 1.4.27.Final-tuxcare.1 of io.undertow:karaf." } }, { "id": "CVE-2019-14888", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:9c8fb7f4-8352-59a5-b8d8-ab4f7d3877dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-14888 affects version 1.4.27.Final-tuxcare.1 of io.undertow:karaf." } }, { "id": "CVE-2019-19343", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:5d3e8bd0-febe-5593-86bd-79937a9316f8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-19343 affects version 1.4.27.Final-tuxcare.1 of io.undertow:karaf." } }, { "id": "CVE-2019-3888", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:f596498b-bbbb-5bca-833f-64a37541e672", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3888 affects version 1.4.27.Final-tuxcare.1 of io.undertow:karaf." } }, { "id": "CVE-2020-10687", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:cfeec563-2016-59c7-854a-56bf86c1a9aa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10687 affects version 1.4.27.Final-tuxcare.1 of io.undertow:karaf." } }, { "id": "CVE-2020-10705", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:8a5d6ad0-8bcb-5b18-b24a-420dec5dc6c3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10705 affects version 1.4.27.Final-tuxcare.1 of io.undertow:karaf." } }, { "id": "CVE-2020-10719", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:bbeeeebc-b7d1-537f-acf5-457874a4fc53", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10719 affects version 1.4.27.Final-tuxcare.1 of io.undertow:karaf." } }, { "id": "CVE-2020-1745", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:12e192c8-6983-5178-a0fd-68a15ef04d15", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1745 affects version 1.4.27.Final-tuxcare.1 of io.undertow:karaf." } }, { "id": "CVE-2020-1757", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:27ba7b80-103d-50f7-8494-ebf7d3d70a74", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1757 affects version 1.4.27.Final-tuxcare.1 of io.undertow:karaf." } }, { "id": "CVE-2020-27782", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:397fb659-bcce-5551-9c95-1119a4e480ab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27782 affects version 1.4.27.Final-tuxcare.1 of io.undertow:karaf." } }, { "id": "CVE-2021-20220", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:591e7e42-d17e-539a-b597-bf0abfe7f34a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-20220 affects version 1.4.27.Final-tuxcare.1 of io.undertow:karaf." } }, { "id": "CVE-2021-3597", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:d5b7737e-0a9d-5652-8272-c273a4f7556a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3597 affects version 1.4.27.Final-tuxcare.1 of io.undertow:karaf." } }, { "id": "CVE-2021-3629", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:397ecb70-eded-56ae-a011-7afdf0be6d11", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3629 affects version 1.4.27.Final-tuxcare.1 of io.undertow:karaf." } }, { "id": "CVE-2021-3690", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:27023521-f8af-5245-9166-0aeb7edeaf7c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3690 affects version 1.4.27.Final-tuxcare.1 of io.undertow:karaf." } }, { "id": "CVE-2021-3859", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:dc722358-aed9-58c8-989b-0f4f3bb999d1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3859 affects version 1.4.27.Final-tuxcare.1 of io.undertow:karaf." } }, { "id": "CVE-2022-1259", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:6c37fa63-d629-5963-a692-edabfcd7af5c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-1259 affects version 1.4.27.Final-tuxcare.1 of io.undertow:karaf." } }, { "id": "CVE-2022-1319", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:8395f530-2eae-5e07-9bd7-892a2961886f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-1319 does not affect version 1.4.27.Final-tuxcare.1 of io.undertow:karaf. Version 1.4.27.Final is not affected by CVE-2022-1319. The vulnerability was introduced in UNDERTOW-1824 (Oct 2020) when the handleBadRequest() method and related AJP response constants were added to versions 2.2.x and later. Version 1.4.27.Final (Jan 2019) predates this change and uses a simpler response mechanism that only calls httpServerExchange.endExchange() once without manual AJP packet generation, making the double-response vulnerability pattern impossible.", "justification": "code_not_present" } }, { "id": "CVE-2022-2053", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:352ceaee-72a9-54c2-a0ac-838631c95b27", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2053 affects version 1.4.27.Final-tuxcare.1 of io.undertow:karaf." } }, { "id": "CVE-2022-4492", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:1968f0c3-be6d-52d8-b5ce-61abf28cb2fd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-4492 affects version 1.4.27.Final-tuxcare.1 of io.undertow:karaf." } }, { "id": "CVE-2023-1108", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:c9f79374-15fa-59ee-a991-28ea48317c72", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-1108 affects version 1.4.27.Final-tuxcare.1 of io.undertow:karaf." } }, { "id": "CVE-2023-1973", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:3cf6f745-8ade-5c09-a14a-642ceed171e7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-1973 affects version 1.4.27.Final-tuxcare.1 of io.undertow:karaf." } }, { "id": "CVE-2023-3223", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:a9f55e1b-2aee-5d57-a9a8-e0ec08cb435a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-3223 affects version 1.4.27.Final-tuxcare.1 of io.undertow:karaf." } }, { "id": "CVE-2023-4639", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:f1ed6e24-a38b-5b0b-9c02-50f4d55e554f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-4639 is fixed in version 1.4.27.Final-tuxcare.1 of io.undertow:karaf." } }, { "id": "CVE-2024-1459", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:1af15947-9c31-5981-a709-89561733aad0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-1459 affects version 1.4.27.Final-tuxcare.1 of io.undertow:karaf." } }, { "id": "CVE-2024-1635", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:10e3a84a-1144-5880-8c51-d76b5105e1e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-1635 affects version 1.4.27.Final-tuxcare.1 of io.undertow:karaf." } }, { "id": "CVE-2024-3653", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:14171373-16fb-5519-a553-475dce13b187", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-3653 affects version 1.4.27.Final-tuxcare.1 of io.undertow:karaf." } }, { "id": "CVE-2024-3884", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:e1a39941-7a93-54c2-8bd9-980109f835cc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-3884 affects version 1.4.27.Final-tuxcare.1 of io.undertow:karaf." } }, { "id": "CVE-2024-4027", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:b27bad68-e9f3-5a65-9f8a-e457bc9af09d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-4027 affects version 1.4.27.Final-tuxcare.1 of io.undertow:karaf." } }, { "id": "CVE-2024-4109", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:98c49381-3e00-5e23-85f7-329da15b879b", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-4109 is a false positive for io.undertow:karaf 1.4.27.Final-tuxcare.1." } }, { "id": "CVE-2024-5971", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:0608c520-245f-5d35-8d3c-4ca336c7411b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-5971 affects version 1.4.27.Final-tuxcare.1 of io.undertow:karaf." } }, { "id": "CVE-2024-6162", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:2c219882-9de1-5971-8dfe-8a78c98e547c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6162 affects version 1.4.27.Final-tuxcare.1 of io.undertow:karaf." } }, { "id": "CVE-2024-7885", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:f6fc11f9-001b-509d-a519-2c9e2cad9a20", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7885 affects version 1.4.27.Final-tuxcare.1 of io.undertow:karaf." } }, { "id": "CVE-2025-12543", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:13622e39-8ff2-5d0b-bc4d-afdbe5bdfc59", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-12543 affects version 1.4.27.Final-tuxcare.1 of io.undertow:karaf." } }, { "id": "CVE-2025-9784", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:160c536d-9747-5573-a9ea-b232cb3bf30d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-9784 affects version 1.4.27.Final-tuxcare.1 of io.undertow:karaf." } }, { "id": "CVE-2026-28367", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:9ced00b6-0007-5379-8742-0db40d953528", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28367 affects version 1.4.27.Final-tuxcare.1 of io.undertow:karaf." } }, { "id": "CVE-2026-28368", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:84590ccd-3e5d-55b1-87fa-b72338bc76c9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28368 affects version 1.4.27.Final-tuxcare.1 of io.undertow:karaf." } }, { "id": "CVE-2026-28369", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:a9f0c935-6739-50bb-abbe-50ed56af3fa8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28369 affects version 1.4.27.Final-tuxcare.1 of io.undertow:karaf." } }, { "id": "CVE-2026-3260", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:3f0723a6-137c-5a3f-950e-95a60602014e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-3260 affects version 1.4.27.Final-tuxcare.1 of io.undertow:karaf." } } ], "dependencies": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.1" } ] }