{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:604d5ab1-f161-5236-a061-64ec66ae9ab6", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "undertow-websockets-jsr", "purl": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.1", "type": "library", "group": "io.undertow", "bom-ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.1", "version": "1.4.27.Final-tuxcare.1", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2017-12196", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:5b1a520a-2c09-527d-944a-cfde1ebb9a7b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12196 does not affect version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr. not_affected \u2014 CVE-2017-12196 is an Undertow Digest-auth flaw: the server failed to verify that the \"digest-uri\" value inside the Authorization header matches the actual HTTP request-line URI, enabling a MITM/credential-reuse attack (a captured Digest credential could be redirected to a different resource). Fixed upstream in 1.4.24.Final (UNDERTOW-1190). The target is undertow 1.4.27.Final (tuxcare.1 backport), which is AFTER the fix version. Direct code inspection confirms the fix is present: DigestAuthenticationMechanism.handleDigestHeader() (core/.../security/impl/DigestAuthenticationMechanism.java:233-257) compares the Authorization \"digest-uri\" token against the reconstructed request URI (path + \"?\" + query) and, as an enhancement, against the absolute request URL; on mismatch it sets 400 BAD_REQUEST and ends the exchange without authenticating, and if the DIGEST_URI token is absent it returns NOT_AUTHENTICATED. The check is on the sole Digest execution path (authenticate() -> handleDigestHeader(), line 167) and precedes credential (H(A2)) validation, with no bypass. git blame attributes lines 233-239 to upstream commit c916239d and lines 240-254 to upstream commit 11b6f0e0, both by Stuart Douglas (stuart.w.douglas@gmail.com). Both commits are ancestors of the plain upstream 1.4.27.Final commit, so the fix shipped upstream before TuxCare onboarding. Verdict: not_affected (upstream fix already present; not a TuxCare backport, so not \"already_fixed\"). [VC re-run with claude-opus-4-8, prod prompt pin d46bd7a, 2026-09-16; Sonnet run failed the author gate (A2 onboarding-merge overclaim); applied manually after git verification]", "justification": "code_not_present" } }, { "id": "CVE-2018-1114", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:a35aca70-ca6f-55e7-b3df-09eed248b8df", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1114 does not affect version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr. not_affected \u2014 Target is Undertow 1.4.27.Final (undertow-io/undertow) \u2014 correct product, not a false positive. CVE-2018-1114 is the file-descriptor leak where URLResource.getLastModified()/getContentLength() opened a URLConnection but closed the underlying stream only at GC finalization, exhausting file descriptors (DoS). The complete upstream fix is already present in the shipped 1.4.27.Final source. URLResource.openConnection() (core/.../resource/URLResource.java:80-110) closes the connection's input stream promptly in a finally block (IoUtils.safeClose(connection.getInputStream()), lines 100-108) and, for jar: URLs, disables caching and reads the timestamp from the underlying jar file directly (setUseCaches(false) + File.lastModified(), lines 92-98) \u2014 exactly the change in the provided patch commits 882d5884/7f22aa0090. git blame attributes these lines to upstream commits 87f4fb41fc (UNDERTOW-1081, 2017-05-24) and 7f22aa0090 (UNDERTOW-1338, 2018-04-24), both ancestors of HEAD, both predating the 1.4.27.Final release. The vulnerable close-on-finalization pattern is therefore absent from HEAD. The fix is upstream-authored (stuart.w.douglas@gmail.com / norito.agetsuma@gmail.com), NOT a TuxCare/CloudLinux backport, and URLResource.java was not modified after onboarding \u2014 so verdict is not_affected (vendor fix already shipped), justification code_not_present. [VC re-run with claude-opus-4-8, prod prompt pin d46bd7a, 2026-09-16; Sonnet run failed the author gate (A2 onboarding-merge overclaim); applied manually after git verification]", "justification": "code_not_present" } }, { "id": "CVE-2018-14642", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:d307b215-42f7-54ec-b331-3cd4b959f866", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-14642 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2019-10184", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:78cb6978-dc0a-5c5d-b429-8cfaee1f9953", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10184 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2019-10212", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:89fc244c-08a9-5d84-90ad-daa5e5bc03d7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10212 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2019-14888", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:e2390735-1f9e-5fc5-a7ac-f658d475ed00", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-14888 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2019-19343", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:d60a9b5b-d16d-5157-b8af-0f4e4dc96c09", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-19343 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2019-3888", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:2cfc7519-0dfd-5128-b03a-0dc45fb549cc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3888 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2020-10687", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:30499952-beb4-5f8f-be34-d790c412bc66", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10687 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2020-10705", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:f63ff84f-556f-5588-abde-b8a5362280f4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10705 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2020-10719", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:1b42767e-2a0b-5dfc-ac58-7d5b21032ef9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10719 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2020-1745", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:d3f8424d-9a79-55be-9534-3e8472dcd23b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1745 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2020-1757", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:66452fbd-008d-541b-8b61-65c88e785e12", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1757 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2020-27782", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:3b70c45d-6b21-55c7-aafe-ff60db228648", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27782 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2021-20220", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:ee942c32-3127-5b9f-99a9-388e9b92082a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-20220 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2021-3597", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:0bcbae95-14d7-56cc-8fa3-9917b8567370", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3597 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2021-3629", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:c488cb8a-6b54-599e-a7ec-95ccf3c4ae0d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3629 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2021-3690", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:f9e8beaa-e118-5397-8612-8eef6f0a5674", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3690 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2021-3859", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:26290434-2380-54c5-9a90-ae6bff4f6b9c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3859 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2022-1259", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:0b6d8d41-1d16-5ca5-bda6-569d43860400", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-1259 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2022-1319", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:b1ef22be-d311-54e3-bbd1-8fabae573812", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-1319 does not affect version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr. Version 1.4.27.Final is not affected by CVE-2022-1319. The vulnerability was introduced in UNDERTOW-1824 (Oct 2020) when the handleBadRequest() method and related AJP response constants were added to versions 2.2.x and later. Version 1.4.27.Final (Jan 2019) predates this change and uses a simpler response mechanism that only calls httpServerExchange.endExchange() once without manual AJP packet generation, making the double-response vulnerability pattern impossible.", "justification": "code_not_present" } }, { "id": "CVE-2022-2053", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:cfb20c1f-8140-5373-b32b-192e1a6f7ab4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2053 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2022-4492", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:0f50fc94-5684-5599-9892-d657fa42a2a4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-4492 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2023-1108", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:5af64d72-b18c-5a02-8be7-c527bd304b92", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-1108 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2023-1973", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:e80d6841-99bd-5a63-a178-250e04f6bf7e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-1973 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2023-3223", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:2b7760be-e23c-5c1c-81b4-d34b46fa824d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-3223 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2023-4639", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:5adfc24d-1233-5ed6-be8d-5c130811b13e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-4639 is fixed in version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2024-1459", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:14e19263-47ce-54fe-89f0-d14f03e96c32", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-1459 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2024-1635", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:d5ec6ecc-ee8f-5fe8-bc01-3fd103b58ad8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-1635 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2024-3653", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:e24ccef4-2075-55f5-8703-0493ceed69c8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-3653 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2024-3884", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:dd3fe945-d5f2-5167-9785-f3438b11aa8b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-3884 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2024-4027", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:159ceb11-177c-579f-9c17-697eaced901e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-4027 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2024-4109", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:7a938949-b65a-5c55-b1d8-e52c3e2a3785", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-4109 is a false positive for io.undertow:undertow-websockets-jsr 1.4.27.Final-tuxcare.1." } }, { "id": "CVE-2024-5971", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:2acd9d82-f978-5801-9955-fb97e721ee2f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-5971 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2024-6162", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:934b53bb-8d3b-5cf7-af00-088eae674eb0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6162 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2024-7885", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:706ffe96-660f-53d5-9bd7-06b8d37e2d49", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7885 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2025-12543", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:4bb3f258-ac79-51a4-a426-fe85025a5035", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-12543 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2025-9784", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:cce52c64-d8ad-5a89-9dfe-e185f21d15ce", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-9784 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2026-28367", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:b4be15bc-d13a-5055-9b65-f5e833a950c7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28367 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2026-28368", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:5eb4a6ac-9639-5563-abe7-85ec880ef8ec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28368 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2026-28369", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:9209c473-901b-564a-b900-e291785f5b10", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28369 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } }, { "id": "CVE-2026-3260", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:4722c12e-cf96-51f5-ba00-32a8dfafed26", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-3260 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-websockets-jsr." } } ], "dependencies": [ { "ref": "pkg:maven/io.undertow/undertow-websockets-jsr@1.4.27.Final-tuxcare.1" } ] }