{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:7aa9af34-c2b5-5300-a094-f04380a425c9",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "undertow-servlet",
      "purl": "pkg:maven/io.undertow/undertow-servlet@2.0.32.Final-tuxcare.2",
      "type": "library",
      "group": "io.undertow",
      "bom-ref": "pkg:maven/io.undertow/undertow-servlet@2.0.32.Final-tuxcare.2",
      "version": "2.0.32.Final-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "undertow-servlet",
            "purl": "pkg:maven/io.undertow/undertow-servlet@2.0.32.Final",
            "type": "library",
            "group": "io.undertow",
            "version": "2.0.32.Final"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2019-10184",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.0.32.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:e0f80334-1e36-57c0-bedc-11f6a2b82a35",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-10184 does not affect version 2.0.32.Final-tuxcare.2 of io.undertow:undertow-servlet. CVE-2019-10184 is not present in Undertow 2.0.32.Final. The vulnerability was fixed by upstream author Lin Gao (commit d2715e3af, July 2019) and shipped in the 2.0.32.Final release that TuxCare onboarded. The fix moves directory redirect logic from ServletInitialHandler to a new RedirectDirHandler positioned before security checks, preventing unauthorized directory structure disclosure via redirect responses.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.23), NVD (< 2.0.23), cve.org (< 2.0.23.Final), Snyk (< 2.0.23.Final).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/io.undertow/undertow-servlet@2.0.32.Final-tuxcare.2"
    }
  ]
}