{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:90897fc6-f0ca-5913-b14f-99c64ee42456", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "undertow-parent", "purl": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.1", "type": "library", "group": "io.undertow", "bom-ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.1", "version": "1.4.27.Final-tuxcare.1", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2017-12196", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:2cc26979-361e-56f0-b5a1-bebde5e2bcb1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12196 does not affect version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parent. not_affected \u2014 CVE-2017-12196 is an Undertow Digest-auth flaw: the server failed to verify that the \"digest-uri\" value inside the Authorization header matches the actual HTTP request-line URI, enabling a MITM/credential-reuse attack (a captured Digest credential could be redirected to a different resource). Fixed upstream in 1.4.24.Final (UNDERTOW-1190). The target is undertow 1.4.27.Final (tuxcare.1 backport), which is AFTER the fix version. Direct code inspection confirms the fix is present: DigestAuthenticationMechanism.handleDigestHeader() (core/.../security/impl/DigestAuthenticationMechanism.java:233-257) compares the Authorization \"digest-uri\" token against the reconstructed request URI (path + \"?\" + query) and, as an enhancement, against the absolute request URL; on mismatch it sets 400 BAD_REQUEST and ends the exchange without authenticating, and if the DIGEST_URI token is absent it returns NOT_AUTHENTICATED. The check is on the sole Digest execution path (authenticate() -> handleDigestHeader(), line 167) and precedes credential (H(A2)) validation, with no bypass. git blame attributes lines 233-239 to upstream commit c916239d and lines 240-254 to upstream commit 11b6f0e0, both by Stuart Douglas (stuart.w.douglas@gmail.com). Both commits are ancestors of the plain upstream 1.4.27.Final commit, so the fix shipped upstream before TuxCare onboarding. Verdict: not_affected (upstream fix already present; not a TuxCare backport, so not \"already_fixed\"). [VC re-run with claude-opus-4-8, prod prompt pin d46bd7a, 2026-09-16; Sonnet run failed the author gate (A2 onboarding-merge overclaim); applied manually after git verification]", "justification": "code_not_present" } }, { "id": "CVE-2018-1114", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:ad91b6b1-dd68-5c14-a487-396afb33672b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1114 does not affect version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parent. not_affected \u2014 Target is Undertow 1.4.27.Final (undertow-io/undertow) \u2014 correct product, not a false positive. CVE-2018-1114 is the file-descriptor leak where URLResource.getLastModified()/getContentLength() opened a URLConnection but closed the underlying stream only at GC finalization, exhausting file descriptors (DoS). The complete upstream fix is already present in the shipped 1.4.27.Final source. URLResource.openConnection() (core/.../resource/URLResource.java:80-110) closes the connection's input stream promptly in a finally block (IoUtils.safeClose(connection.getInputStream()), lines 100-108) and, for jar: URLs, disables caching and reads the timestamp from the underlying jar file directly (setUseCaches(false) + File.lastModified(), lines 92-98) \u2014 exactly the change in the provided patch commits 882d5884/7f22aa0090. git blame attributes these lines to upstream commits 87f4fb41fc (UNDERTOW-1081, 2017-05-24) and 7f22aa0090 (UNDERTOW-1338, 2018-04-24), both ancestors of HEAD, both predating the 1.4.27.Final release. The vulnerable close-on-finalization pattern is therefore absent from HEAD. The fix is upstream-authored (stuart.w.douglas@gmail.com / norito.agetsuma@gmail.com), NOT a TuxCare/CloudLinux backport, and URLResource.java was not modified after onboarding \u2014 so verdict is not_affected (vendor fix already shipped), justification code_not_present. [VC re-run with claude-opus-4-8, prod prompt pin d46bd7a, 2026-09-16; Sonnet run failed the author gate (A2 onboarding-merge overclaim); applied manually after git verification]", "justification": "code_not_present" } }, { "id": "CVE-2018-14642", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:813abec6-facd-52d4-b2da-c9b4337b3f5b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-14642 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parent." } }, { "id": "CVE-2019-10184", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:192afbbc-0934-5934-81bd-ca2cddf8880d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10184 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parent." } }, { "id": "CVE-2019-10212", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:dfeb643d-6ea7-523d-ace8-810ce0163397", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10212 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parent." } }, { "id": "CVE-2019-14888", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:aa11cf89-5617-5040-b482-a15dfcee6d62", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-14888 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parent." } }, { "id": "CVE-2019-19343", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:1a1aacee-43b3-539d-9a69-58b1168dcad9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-19343 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parent." } }, { "id": "CVE-2019-3888", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:a95560ef-51bc-578a-99a9-41c8f600ae97", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3888 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parent." } }, { "id": "CVE-2020-10687", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:d1d8f6ec-d01c-5413-8f17-6349ab505204", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10687 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parent." } }, { "id": "CVE-2020-10705", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:66cc96ad-355a-5079-a8f1-c65b6fe650fa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10705 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parent." } }, { "id": "CVE-2020-10719", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:72c4d6ce-d95c-53eb-88f3-023de36517b7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10719 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parent." } }, { "id": "CVE-2020-1745", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:3929d4fd-9906-5b9b-94d6-55ad6f516ed6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1745 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parent." } }, { "id": "CVE-2020-1757", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:bd7d34af-9bb5-5ef1-bea3-025a0e040555", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1757 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parent." } }, { "id": "CVE-2020-27782", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:6a10975a-083d-570a-b4c9-81f76afb06d1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27782 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parent." } }, { "id": "CVE-2021-20220", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:36a67920-3acb-5f1e-90ac-e3aa317f179a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-20220 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parent." } }, { "id": "CVE-2021-3597", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:29effb32-338b-5823-bf4d-c3cbc259e8c3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3597 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parent." } }, { "id": "CVE-2021-3629", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:def478b0-6e69-57d3-989b-d679e24537b1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3629 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parent." } }, { "id": "CVE-2021-3690", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:68073463-8160-5135-b716-5a2596029e3c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3690 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parent." } }, { "id": "CVE-2021-3859", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:a0cbe55b-54da-568a-8dc1-5b46f6df5ee7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3859 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parent." } }, { "id": "CVE-2022-1259", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:42ab4bcc-e756-59c8-bde6-cb41ef44345d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-1259 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parent." } }, { "id": "CVE-2022-1319", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:9140bcc7-f884-5e0d-8ee5-68ae98d95042", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-1319 does not affect version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parent. Version 1.4.27.Final is not affected by CVE-2022-1319. The vulnerability was introduced in UNDERTOW-1824 (Oct 2020) when the handleBadRequest() method and related AJP response constants were added to versions 2.2.x and later. Version 1.4.27.Final (Jan 2019) predates this change and uses a simpler response mechanism that only calls httpServerExchange.endExchange() once without manual AJP packet generation, making the double-response vulnerability pattern impossible.", "justification": "code_not_present" } }, { "id": "CVE-2022-2053", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:c74f501d-1e6b-559d-826c-a6356707858f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2053 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parent." } }, { "id": "CVE-2022-4492", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:a1dfe1bd-6044-5da7-824a-d20f692f8048", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-4492 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parent." } }, { "id": "CVE-2023-1108", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:bae1b8ae-3796-5cbe-9458-0f204baa69e6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-1108 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parent." } }, { "id": "CVE-2023-1973", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:d28e21e3-eac2-563d-b8df-6e3f3fd95f5c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-1973 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parent." } }, { "id": "CVE-2023-3223", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:bd475701-8041-5d2e-87d1-824e67777a81", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-3223 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parent." } }, { "id": "CVE-2023-4639", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:10836b9d-0bc2-5802-9ed9-deb946388cea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-4639 is fixed in version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parent." } }, { "id": "CVE-2024-1459", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:e1822dc5-aab8-5a80-ae74-e9c6fc782bd7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-1459 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parent." } }, { "id": "CVE-2024-1635", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:567408f1-3c63-5187-8c3f-2c04368f0b17", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-1635 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parent." } }, { "id": "CVE-2024-3653", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:777363bf-8c1c-5188-b167-0f9450cedce8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-3653 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parent." } }, { "id": "CVE-2024-3884", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:a4c27266-c38c-5c31-9c54-233df9ffd0ba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-3884 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parent." } }, { "id": "CVE-2024-4027", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:b5189abc-d82b-5131-941e-b6d86e6143a7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-4027 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parent." } }, { "id": "CVE-2024-4109", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:796afcd3-ab2f-58fa-a073-6b4701326299", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-4109 is a false positive for io.undertow:undertow-parent 1.4.27.Final-tuxcare.1." } }, { "id": "CVE-2024-5971", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:7a8e385a-84be-5a64-850b-112500070bcf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-5971 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parent." } }, { "id": "CVE-2024-6162", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:be0bd3e5-ee4a-57e0-9dae-2ab1911576db", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6162 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parent." } }, { "id": "CVE-2024-7885", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:545e7e97-e0b4-51da-8d5a-18aaa9ef1909", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7885 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parent." } }, { "id": "CVE-2025-12543", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:97700a12-d6d8-5cc2-a018-f72123c7b734", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-12543 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parent." } }, { "id": "CVE-2025-9784", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:0d0ce2ce-0079-5a2a-ba10-6cc4744d1d88", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-9784 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parent." } }, { "id": "CVE-2026-28367", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:1941da3b-8755-5a99-8847-c222d4b0a53d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28367 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parent." } }, { "id": "CVE-2026-28368", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:285ff1fd-6a8c-598e-b4d4-2d1416bc6d0f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28368 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parent." } }, { "id": "CVE-2026-28369", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:32efe080-c368-530a-bbd3-fa40bc714578", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28369 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parent." } }, { "id": "CVE-2026-3260", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:ec1467d2-495e-50c6-9e37-4f19781ad94a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-3260 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-parent." } } ], "dependencies": [ { "ref": "pkg:maven/io.undertow/undertow-parent@1.4.27.Final-tuxcare.1" } ] }