{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:01d606e3-25e4-56c1-b28f-cfa6b1409558",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "undertow-servlet",
      "purl": "pkg:maven/io.undertow/undertow-servlet@2.2.24.Final-tuxcare.2",
      "type": "library",
      "group": "io.undertow",
      "bom-ref": "pkg:maven/io.undertow/undertow-servlet@2.2.24.Final-tuxcare.2",
      "version": "2.2.24.Final-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "undertow-servlet",
            "purl": "pkg:maven/io.undertow/undertow-servlet@2.2.24.Final",
            "type": "library",
            "group": "io.undertow",
            "version": "2.2.24.Final"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2019-10184",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.2.24.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:3aeb95e5-f986-5dea-a499-0bad1937ee55",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-10184 does not affect version 2.2.24.Final-tuxcare.2 of io.undertow:undertow-servlet. CVE-2019-10184 is NOT present in undertow 2.2.24.Final. The vulnerability allowed attackers to predict protected directory structures through unauthenticated requests without trailing slashes. The upstream vendor (Red Hat/JBoss) fixed this in commit d2715e3af by moving redirect logic to a new RedirectDirHandler positioned BEFORE security checks in the handler chain. This fix was already included in upstream version 2.2.24.Final when TuxCare onboarded it (commit 7f3aff38). The target contains the complete fix: RedirectDirHandler exists and is correctly positioned before security handlers in DeploymentManagerImpl.java:224, and the vulnerable redirect logic has been removed from ServletInitialHandler.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.23), NVD (< 2.0.23), cve.org (< 2.0.23.Final), Snyk (< 2.0.23.Final).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/io.undertow/undertow-servlet@2.2.24.Final-tuxcare.2"
    }
  ]
}