{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e40171c5-7ec9-5eec-bef6-651feed394bf", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "undertow-examples", "purl": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.1", "type": "library", "group": "io.undertow", "bom-ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.1", "version": "1.4.27.Final-tuxcare.1", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2017-12196", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:64fc80eb-efeb-5b40-86e0-ea7aaa759587", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12196 does not affect version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-examples. not_affected \u2014 CVE-2017-12196 is an Undertow Digest-auth flaw: the server failed to verify that the \"digest-uri\" value inside the Authorization header matches the actual HTTP request-line URI, enabling a MITM/credential-reuse attack (a captured Digest credential could be redirected to a different resource). Fixed upstream in 1.4.24.Final (UNDERTOW-1190). The target is undertow 1.4.27.Final (tuxcare.1 backport), which is AFTER the fix version. Direct code inspection confirms the fix is present: DigestAuthenticationMechanism.handleDigestHeader() (core/.../security/impl/DigestAuthenticationMechanism.java:233-257) compares the Authorization \"digest-uri\" token against the reconstructed request URI (path + \"?\" + query) and, as an enhancement, against the absolute request URL; on mismatch it sets 400 BAD_REQUEST and ends the exchange without authenticating, and if the DIGEST_URI token is absent it returns NOT_AUTHENTICATED. The check is on the sole Digest execution path (authenticate() -> handleDigestHeader(), line 167) and precedes credential (H(A2)) validation, with no bypass. git blame attributes lines 233-239 to upstream commit c916239d and lines 240-254 to upstream commit 11b6f0e0, both by Stuart Douglas (stuart.w.douglas@gmail.com). Both commits are ancestors of the plain upstream 1.4.27.Final commit, so the fix shipped upstream before TuxCare onboarding. Verdict: not_affected (upstream fix already present; not a TuxCare backport, so not \"already_fixed\"). [VC re-run with claude-opus-4-8, prod prompt pin d46bd7a, 2026-09-16; Sonnet run failed the author gate (A2 onboarding-merge overclaim); applied manually after git verification]", "justification": "code_not_present" } }, { "id": "CVE-2018-1114", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:9bc160ed-a2f2-53f1-a1e1-fa3259368975", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1114 does not affect version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-examples. not_affected \u2014 Target is Undertow 1.4.27.Final (undertow-io/undertow) \u2014 correct product, not a false positive. CVE-2018-1114 is the file-descriptor leak where URLResource.getLastModified()/getContentLength() opened a URLConnection but closed the underlying stream only at GC finalization, exhausting file descriptors (DoS). The complete upstream fix is already present in the shipped 1.4.27.Final source. URLResource.openConnection() (core/.../resource/URLResource.java:80-110) closes the connection's input stream promptly in a finally block (IoUtils.safeClose(connection.getInputStream()), lines 100-108) and, for jar: URLs, disables caching and reads the timestamp from the underlying jar file directly (setUseCaches(false) + File.lastModified(), lines 92-98) \u2014 exactly the change in the provided patch commits 882d5884/7f22aa0090. git blame attributes these lines to upstream commits 87f4fb41fc (UNDERTOW-1081, 2017-05-24) and 7f22aa0090 (UNDERTOW-1338, 2018-04-24), both ancestors of HEAD, both predating the 1.4.27.Final release. The vulnerable close-on-finalization pattern is therefore absent from HEAD. The fix is upstream-authored (stuart.w.douglas@gmail.com / norito.agetsuma@gmail.com), NOT a TuxCare/CloudLinux backport, and URLResource.java was not modified after onboarding \u2014 so verdict is not_affected (vendor fix already shipped), justification code_not_present. [VC re-run with claude-opus-4-8, prod prompt pin d46bd7a, 2026-09-16; Sonnet run failed the author gate (A2 onboarding-merge overclaim); applied manually after git verification]", "justification": "code_not_present" } }, { "id": "CVE-2018-14642", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:354c1c4a-523d-5084-b2f1-c6b4eaf625a7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-14642 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-examples." } }, { "id": "CVE-2019-10184", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:607e7521-8a55-5fea-a6e5-e603d961d81d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10184 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-examples." } }, { "id": "CVE-2019-10212", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:599f0deb-e4c7-597b-a201-d911fcdebe97", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10212 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-examples." } }, { "id": "CVE-2019-14888", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:12e5b327-2444-5aed-ab37-a128c59745b6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-14888 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-examples." } }, { "id": "CVE-2019-19343", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:7a59997c-5981-549b-85f7-ea151577d819", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-19343 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-examples." } }, { "id": "CVE-2019-3888", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:7bb9504b-377f-5cca-8513-22534bbd8ef9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3888 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-examples." } }, { "id": "CVE-2020-10687", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:4837621d-5194-5af7-8a86-b22b90736cb8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10687 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-examples." } }, { "id": "CVE-2020-10705", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:e1dbdb23-6452-579f-a6c8-47154449e82f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10705 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-examples." } }, { "id": "CVE-2020-10719", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:c7387e29-ad0e-5fbf-9510-18058ab38d67", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10719 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-examples." } }, { "id": "CVE-2020-1745", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:ace40119-1dea-53ac-8c89-49ada3c6dbc7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1745 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-examples." } }, { "id": "CVE-2020-1757", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:7a0b6e37-b4df-56ce-8690-be2e4bc92262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1757 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-examples." } }, { "id": "CVE-2020-27782", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:302fc086-8eb0-530e-9fe6-2dd82b830e5f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27782 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-examples." } }, { "id": "CVE-2021-20220", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:f34bc3e0-18a5-56fb-adb4-241d21e55a9c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-20220 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-examples." } }, { "id": "CVE-2021-3597", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:7c8f6c83-a085-5759-b60a-ae735482d882", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3597 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-examples." } }, { "id": "CVE-2021-3629", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:f9ee2dc5-275a-53cb-bb06-9f9bf061a858", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3629 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-examples." } }, { "id": "CVE-2021-3690", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:d5bab4fc-7e30-5292-83a0-7d3baa1e68ae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3690 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-examples." } }, { "id": "CVE-2021-3859", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:f06098f4-782a-59bf-817f-bf56fb7a2259", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3859 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-examples." } }, { "id": "CVE-2022-1259", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:75e86a17-b89f-507a-804a-a5664c576ea7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-1259 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-examples." } }, { "id": "CVE-2022-1319", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:afa0a0d3-7b6d-5071-b350-d98a997460af", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-1319 does not affect version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-examples. Version 1.4.27.Final is not affected by CVE-2022-1319. The vulnerability was introduced in UNDERTOW-1824 (Oct 2020) when the handleBadRequest() method and related AJP response constants were added to versions 2.2.x and later. Version 1.4.27.Final (Jan 2019) predates this change and uses a simpler response mechanism that only calls httpServerExchange.endExchange() once without manual AJP packet generation, making the double-response vulnerability pattern impossible.", "justification": "code_not_present" } }, { "id": "CVE-2022-2053", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:f4f3db53-1a84-5894-a215-75357a8d1a4f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2053 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-examples." } }, { "id": "CVE-2022-4492", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:923d9df5-72ef-5025-9b56-ea45511089c3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-4492 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-examples." } }, { "id": "CVE-2023-1108", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:fbab5fba-db57-5e45-a931-a7727f41b1f0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-1108 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-examples." } }, { "id": "CVE-2023-1973", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:3017325f-c753-5372-8625-9976e02e7ad6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-1973 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-examples." } }, { "id": "CVE-2023-3223", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:39874500-c2b0-50e4-aa24-645c24a06339", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-3223 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-examples." } }, { "id": "CVE-2023-4639", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:763e706b-5a39-5911-8030-691688789aa1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-4639 is fixed in version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-examples." } }, { "id": "CVE-2024-1459", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:6fb17407-6ca8-5cd6-9b8a-b065f6e332c2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-1459 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-examples." } }, { "id": "CVE-2024-1635", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:66048794-6245-5860-b26e-19bd23bf97a0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-1635 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-examples." } }, { "id": "CVE-2024-3653", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:f5a0d5ac-33a4-5553-ad70-e55a395512ca", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-3653 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-examples." } }, { "id": "CVE-2024-3884", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:e588ba16-33ce-5091-8e10-199b3bc7f337", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-3884 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-examples." } }, { "id": "CVE-2024-4027", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:b446fb23-ccb3-5fee-9362-baaaa1e58827", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-4027 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-examples." } }, { "id": "CVE-2024-4109", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:fd8658ca-e40b-537d-be0b-b85b131b74db", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-4109 is a false positive for io.undertow:undertow-examples 1.4.27.Final-tuxcare.1." } }, { "id": "CVE-2024-5971", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:65291641-4b3b-5ed1-bbeb-b11a5a904e7b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-5971 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-examples." } }, { "id": "CVE-2024-6162", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:49f6a0d5-6796-5db6-9f70-5cd5c3fdd35a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6162 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-examples." } }, { "id": "CVE-2024-7885", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:5dabb037-3a1a-5b10-9c06-ca7fd7697a02", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7885 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-examples." } }, { "id": "CVE-2025-12543", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:2af64d10-b622-55cb-a3af-372e118f728a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-12543 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-examples." } }, { "id": "CVE-2025-9784", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:dab0307b-f555-5329-9fa9-06a90a93d97f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-9784 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-examples." } }, { "id": "CVE-2026-28367", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:406d92b0-6d83-5a3b-a111-871bf4ac5ebb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28367 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-examples." } }, { "id": "CVE-2026-28368", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:1f798751-c366-57b2-97f1-60415b2afc58", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28368 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-examples." } }, { "id": "CVE-2026-28369", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:72e65579-8d00-5e3c-bda7-e0d5f11151cc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28369 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-examples." } }, { "id": "CVE-2026-3260", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:560ced7b-6c47-59d0-9979-f25e9f4f41d5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-3260 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-examples." } } ], "dependencies": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.1" } ] }