{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:fbbd7f97-36ab-58fc-bce4-e765601026c2",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "undertow-servlet",
      "purl": "pkg:maven/io.undertow/undertow-servlet@2.3.24.Final-tuxcare.1",
      "type": "library",
      "group": "io.undertow",
      "bom-ref": "pkg:maven/io.undertow/undertow-servlet@2.3.24.Final-tuxcare.1",
      "version": "2.3.24.Final-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "undertow-servlet",
            "purl": "pkg:maven/io.undertow/undertow-servlet@2.3.24.Final",
            "type": "library",
            "group": "io.undertow",
            "version": "2.3.24.Final"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2019-10184",
      "affects": [
        {
          "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.24.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:696e400c-683d-509d-be04-d9a519a5c099",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-10184 does not affect version 2.3.24.Final-tuxcare.1 of io.undertow:undertow-servlet. CVE-2019-10184 is not present in Undertow 2.3.24.Final. The vulnerability was fixed in upstream commit d2715e3af by Lin Gao on 2019-07-24, which shipped in the upstream 2.3.24.Final release. The fix moves directory redirect handling (RedirectDirHandler) to occur BEFORE security checks in the handler chain, preventing information disclosure about protected directory structures. TuxCare onboarded this already-fixed version on 2024-02-28 (commit a7d66ffbd by evasilev@cloudlinux.com). The vulnerable pattern (redirect logic in ServletInitialHandler after security checks) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.0.23), NVD (< 2.0.23), cve.org (< 2.0.23.Final), Snyk (< 2.0.23.Final).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/io.undertow/undertow-servlet@2.3.24.Final-tuxcare.1"
    }
  ]
}