{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:6cdb3f7f-569e-5754-8704-2c3005d8de0d",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "undertow-servlet",
      "purl": "pkg:maven/io.undertow/undertow-servlet@2.3.10.Final-tuxcare.8",
      "type": "library",
      "group": "io.undertow",
      "bom-ref": "pkg:maven/io.undertow/undertow-servlet@2.3.10.Final-tuxcare.8",
      "version": "2.3.10.Final-tuxcare.8",
      "pedigree": {
        "ancestors": [
          {
            "name": "undertow-servlet",
            "purl": "pkg:maven/io.undertow/undertow-servlet@2.3.10.Final",
            "type": "library",
            "group": "io.undertow",
            "version": "2.3.10.Final"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2019-10184",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.10.Final-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:dee69e08-1ee4-5979-9f68-aefce484f1a4",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-10184 does not affect version 2.3.10.Final-tuxcare.8 of io.undertow:undertow-servlet. CVE-2019-10184 affects undertow before version 2.0.23.Final. The target version 2.3.10.Final-tuxcare.8 contains the upstream fix (commit d2715e3af by Lin Gao, July 24, 2019) that was shipped in upstream release 2.0.23.Final (July 30, 2019). The fix reordered the handler chain to place RedirectDirHandler before the security handler, ensuring authentication is required before the server issues redirect responses that would confirm directory existence. The vulnerable code pattern (issuing redirects before security checks) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.23), NVD (< 2.0.23), cve.org (< 2.0.23.Final), Snyk (< 2.0.23.Final).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.10.Final-tuxcare.8"
    }
  ]
}