{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:a5ca6a9e-0790-5c80-9a02-cefa2be95a38",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "undertow-servlet",
      "purl": "pkg:maven/io.undertow/undertow-servlet@2.2.17.Final-tuxcare.1",
      "type": "library",
      "group": "io.undertow",
      "bom-ref": "pkg:maven/io.undertow/undertow-servlet@2.2.17.Final-tuxcare.1",
      "version": "2.2.17.Final-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "undertow-servlet",
            "purl": "pkg:maven/io.undertow/undertow-servlet@2.2.17.Final",
            "type": "library",
            "group": "io.undertow",
            "version": "2.2.17.Final"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2019-10184",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.2.17.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:1ed8df37-43e6-5e87-9565-6df7c5491e21",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-10184 does not affect version 2.2.17.Final-tuxcare.1 of io.undertow:undertow-servlet. CVE-2019-10184 affects Undertow before version 2.0.23.Final. The target version 2.2.17.Final contains the upstream fix (commit d2715e3af by Lin Gao) that shipped in release 2.0.23.Final. The fix creates RedirectDirHandler to handle directory redirects after authentication checks, preventing unauthorized directory structure disclosure. The vulnerable pattern (issuing redirects before authentication) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.23), NVD (< 2.0.23), cve.org (< 2.0.23.Final), Snyk (< 2.0.23.Final).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-1259",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.2.17.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:5d75f7cd-6aa2-5d2a-abf7-6395c6ff1412",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-1259 affects version 2.2.17.Final-tuxcare.1 of io.undertow:undertow-servlet."
      }
    },
    {
      "id": "CVE-2022-1319",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.2.17.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:08d8a569-8ce7-5bbc-9935-98b1f546416e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-1319 affects version 2.2.17.Final-tuxcare.1 of io.undertow:undertow-servlet."
      }
    },
    {
      "id": "CVE-2022-2764",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.2.17.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0c663007-d85c-58fd-8f08-9dd009e7fe42",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-2764 affects version 2.2.17.Final-tuxcare.1 of io.undertow:undertow-servlet."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/io.undertow/undertow-servlet@2.2.17.Final-tuxcare.1"
    }
  ]
}