{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:98fd4496-6278-5fb0-8c3d-df1b81bac2d8",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "undertow-servlet",
      "purl": "pkg:maven/io.undertow/undertow-servlet@2.3.0.Final-tuxcare.4",
      "type": "library",
      "group": "io.undertow",
      "bom-ref": "pkg:maven/io.undertow/undertow-servlet@2.3.0.Final-tuxcare.4",
      "version": "2.3.0.Final-tuxcare.4",
      "pedigree": {
        "ancestors": [
          {
            "name": "undertow-servlet",
            "purl": "pkg:maven/io.undertow/undertow-servlet@2.3.0.Final",
            "type": "library",
            "group": "io.undertow",
            "version": "2.3.0.Final"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2019-10184",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.0.Final-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:4d709540-501f-506e-8688-1983dd4047bd",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-10184 does not affect version 2.3.0.Final-tuxcare.4 of io.undertow:undertow-servlet. CVE-2019-10184: Target version 2.3.0.Final is NOT AFFECTED. The vulnerability (information leak through directory structure disclosure via requests without trailing slashes) was fixed in the upstream Undertow release before TuxCare onboarded version 2.3.0.Final. The fix (commit d2715e3af by Lin Gao) moved redirect handling from ServletInitialHandler to a new RedirectDirHandler that executes AFTER security checks, preventing unauthorized directory enumeration. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.23), NVD (< 2.0.23), cve.org (< 2.0.23.Final), Snyk (< 2.0.23.Final).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-1259",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.0.Final-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:6c3d47d8-4cad-5bc2-95b6-065a8f5a4fe3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-1259 affects version 2.3.0.Final-tuxcare.4 of io.undertow:undertow-servlet."
      }
    },
    {
      "id": "CVE-2022-1319",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.0.Final-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:b68c0fe0-9c14-53fc-959d-049410d2242e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-1319 does not affect version 2.3.0.Final-tuxcare.4 of io.undertow:undertow-servlet. already_fixed \u2014 CVE-2022-1319 (UNDERTOW-2060) has been fixed in the target repository. The fix commit eefae287893fc79736c9573975a9c96c3161cab0 from April 8, 2022 is present and contains both required defense mechanisms: (1) END_RESPONSE reuse flag changed from 1 to 0 to signal connection non-reusability after errors, and (2) removal of duplicate handleBadRequest() call to prevent sending two response packets.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-2764",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.0.Final-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:2e6259aa-e376-5370-9b87-b1ea489141ca",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-2764 does not affect version 2.3.0.Final-tuxcare.4 of io.undertow:undertow-servlet. already_fixed \u2014 CVE-2022-2764 (UNDERTOW-2048) has already been fixed in the target repository. The fix was applied via commits 5f3b1f269, 05ab8777e, and f60972d29 on the master branch, implementing timeout protection for blocking read operations in UndertowInputStream.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.0.Final-tuxcare.4"
    }
  ]
}