{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ef702b05-1356-5327-9703-c4dec5270f07", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "undertow-core", "purl": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.1", "type": "library", "group": "io.undertow", "bom-ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.1", "version": "1.4.27.Final-tuxcare.1", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2017-12196", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:a7e30dba-13b6-5514-8142-9e5da8b10b59", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12196 does not affect version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-core. not_affected \u2014 CVE-2017-12196 is an Undertow Digest-auth flaw: the server failed to verify that the \"digest-uri\" value inside the Authorization header matches the actual HTTP request-line URI, enabling a MITM/credential-reuse attack (a captured Digest credential could be redirected to a different resource). Fixed upstream in 1.4.24.Final (UNDERTOW-1190). The target is undertow 1.4.27.Final (tuxcare.1 backport), which is AFTER the fix version. Direct code inspection confirms the fix is present: DigestAuthenticationMechanism.handleDigestHeader() (core/.../security/impl/DigestAuthenticationMechanism.java:233-257) compares the Authorization \"digest-uri\" token against the reconstructed request URI (path + \"?\" + query) and, as an enhancement, against the absolute request URL; on mismatch it sets 400 BAD_REQUEST and ends the exchange without authenticating, and if the DIGEST_URI token is absent it returns NOT_AUTHENTICATED. The check is on the sole Digest execution path (authenticate() -> handleDigestHeader(), line 167) and precedes credential (H(A2)) validation, with no bypass. git blame attributes lines 233-239 to upstream commit c916239d and lines 240-254 to upstream commit 11b6f0e0, both by Stuart Douglas (stuart.w.douglas@gmail.com). Both commits are ancestors of the plain upstream 1.4.27.Final commit, so the fix shipped upstream before TuxCare onboarding. Verdict: not_affected (upstream fix already present; not a TuxCare backport, so not \"already_fixed\"). [VC re-run with claude-opus-4-8, prod prompt pin d46bd7a, 2026-09-16; Sonnet run failed the author gate (A2 onboarding-merge overclaim); applied manually after git verification]", "justification": "code_not_present" } }, { "id": "CVE-2018-1114", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:99f889ee-110a-5c1e-ad0b-cf88f0011843", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1114 does not affect version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-core. not_affected \u2014 Target is Undertow 1.4.27.Final (undertow-io/undertow) \u2014 correct product, not a false positive. CVE-2018-1114 is the file-descriptor leak where URLResource.getLastModified()/getContentLength() opened a URLConnection but closed the underlying stream only at GC finalization, exhausting file descriptors (DoS). The complete upstream fix is already present in the shipped 1.4.27.Final source. URLResource.openConnection() (core/.../resource/URLResource.java:80-110) closes the connection's input stream promptly in a finally block (IoUtils.safeClose(connection.getInputStream()), lines 100-108) and, for jar: URLs, disables caching and reads the timestamp from the underlying jar file directly (setUseCaches(false) + File.lastModified(), lines 92-98) \u2014 exactly the change in the provided patch commits 882d5884/7f22aa0090. git blame attributes these lines to upstream commits 87f4fb41fc (UNDERTOW-1081, 2017-05-24) and 7f22aa0090 (UNDERTOW-1338, 2018-04-24), both ancestors of HEAD, both predating the 1.4.27.Final release. The vulnerable close-on-finalization pattern is therefore absent from HEAD. The fix is upstream-authored (stuart.w.douglas@gmail.com / norito.agetsuma@gmail.com), NOT a TuxCare/CloudLinux backport, and URLResource.java was not modified after onboarding \u2014 so verdict is not_affected (vendor fix already shipped), justification code_not_present. [VC re-run with claude-opus-4-8, prod prompt pin d46bd7a, 2026-09-16; Sonnet run failed the author gate (A2 onboarding-merge overclaim); applied manually after git verification]", "justification": "code_not_present" } }, { "id": "CVE-2018-14642", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:15ece4a9-9a33-5c57-b8a0-11e412c58993", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-14642 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2019-10184", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:b2238ed2-6451-5723-921c-350048543995", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10184 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2019-10212", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:2a507473-190f-5fbe-ab59-c39010c80c62", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10212 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2019-14888", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:92e5b257-682e-5e8a-9929-aef5b48a8665", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-14888 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2019-19343", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:0079cfe0-0616-5647-baba-a472458f7a92", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-19343 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2019-3888", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:d6fbc1bc-5858-5084-b331-2c6e442fc0eb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3888 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2020-10687", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:6b8f36a6-16c3-55f5-8e97-276b9c227864", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10687 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2020-10705", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:44b08b57-d640-5a4b-b139-51b14ee77609", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10705 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2020-10719", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:62007242-2529-5fa7-b666-76dcf06a5865", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10719 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2020-1745", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:34db1a52-5c3d-5317-811e-375148c957b7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1745 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2020-1757", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:88c031d9-b6b2-518d-8ca3-d7b3d644a1c6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1757 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2020-27782", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:d2a8cd96-153c-5ba4-8cde-6b9264b39a8b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27782 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2021-20220", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:fe36e73c-c3f5-5791-a5bd-cb834df6d351", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-20220 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2021-3597", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:159339b1-14c0-59ff-b1d7-646abcd8353e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3597 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2021-3629", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:e443bc85-b0fe-5788-8b3b-59615ef973e8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3629 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2021-3690", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:8bfad6d1-9c0a-5c17-ac77-9eef8bce0a17", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3690 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2021-3859", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:6d88772b-491c-544a-93cb-0e901992fa91", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3859 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2022-1259", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:dccfc0b9-f799-58a8-883f-b9a9d31217a7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-1259 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2022-1319", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:d91bcfd9-c393-5ae8-bc18-d4c5c26e70c8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-1319 does not affect version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-core. Version 1.4.27.Final is not affected by CVE-2022-1319. The vulnerability was introduced in UNDERTOW-1824 (Oct 2020) when the handleBadRequest() method and related AJP response constants were added to versions 2.2.x and later. Version 1.4.27.Final (Jan 2019) predates this change and uses a simpler response mechanism that only calls httpServerExchange.endExchange() once without manual AJP packet generation, making the double-response vulnerability pattern impossible.", "justification": "code_not_present" } }, { "id": "CVE-2022-2053", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:a0d01513-8bf2-5582-82e7-ae91c93d002c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2053 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2022-4492", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:51c6bf99-1750-5a06-88c4-0654261185f3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-4492 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2023-1108", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:b6c6567f-8d97-5207-8223-0e16ee78bd1c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-1108 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2023-1973", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:ca659a44-51e0-5fe9-9a01-706e8ce9322d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-1973 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2023-3223", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:d936614e-e355-59c4-bf37-a03f09f92d1c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-3223 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2023-4639", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:1af8fb12-e67c-5ea2-aff7-58af6ca3a8f9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-4639 is fixed in version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2024-1459", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:95007f87-d103-586a-bc1c-00a2139d949f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-1459 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2024-1635", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:3e0d0606-f0b7-5774-95f8-035c43fb0dc6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-1635 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2024-3653", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:028beae4-0859-5cad-a684-54ae4260896c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-3653 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2024-3884", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:bede1747-2c7f-5c3c-b923-9c8b56becc13", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-3884 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2024-4027", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:a3c7a9e8-599a-5f96-a908-0469d3443898", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-4027 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2024-4109", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:97ba85e7-dea3-5e49-b943-21ea7f0fb75f", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-4109 is a false positive for io.undertow:undertow-core 1.4.27.Final-tuxcare.1." } }, { "id": "CVE-2024-5971", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:e78fd2c7-4c73-5ae2-bb86-c53b86ac615a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-5971 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2024-6162", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:71c1e530-4af0-5a5e-b8e1-65c93650e80e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6162 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2024-7885", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:d9f12404-0cd5-5764-8d02-d7c8b59e4830", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7885 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2025-12543", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:f636d6d5-5067-548d-9e61-66dc99dca940", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-12543 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2025-9784", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:0453b8fd-ee17-5842-9eda-b510486e1cc3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-9784 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2026-28367", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:599a850c-98f8-59f0-a6df-e20db9647ad2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28367 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2026-28368", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:27eaceee-7929-5969-ae68-9656716a160a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28368 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2026-28369", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:de87b452-d188-5487-87e8-0d20dda99560", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28369 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-core." } }, { "id": "CVE-2026-3260", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:5288d22b-77c2-5257-9c17-8ac1f493584b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-3260 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-core." } } ], "dependencies": [ { "ref": "pkg:maven/io.undertow/undertow-core@1.4.27.Final-tuxcare.1" } ] }