{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:3ca8744c-e33e-5552-8d85-acdb4213ae45",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "jetty-ee8-servlets",
      "purl": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-servlets@12.0.22-tuxcare.1",
      "type": "library",
      "group": "org.eclipse.jetty.ee8",
      "bom-ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-servlets@12.0.22-tuxcare.1",
      "version": "12.0.22-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "jetty-ee8-servlets",
            "purl": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-servlets@12.0.22",
            "type": "library",
            "group": "org.eclipse.jetty.ee8",
            "version": "12.0.22"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2007-1651",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-servlets@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9957c5e8-61a0-58a4-89db-4b19d4067827",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2007-1651 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-servlets. Target Jetty 12.0.22 is NOT affected. The CVE concerns a CSRF / session-restoration weakness in Jetty's OpenID Connect support; the two vendor patches (5f2c96dc, 2020 \u2014 move ID-token expiry to initial-auth-only + proper logout/validate delegation; e9f260f4, 2021 \u2014 replace the single anti-forgery CSRF token with a per-session, SecureRandom-keyed csrfMap and mandatory `state` validation) are UPSTREAM Jetty fixes authored by lachlan@webtide.com years before the 12.0.22 release (June 2025). Both fix commits are ancestors of HEAD, and the shipped jetty-core/jetty-openid and jetty-ee9/jetty-ee9-openid modules contain the complete post-fix code. The pre-fix vulnerable pattern (single CSRF_TOKEN setAttribute, isExpired() gating session validity, empty logout()) is absent. Not a TuxCare backport \u2014 the fix is native/upstream, so verdict is not_affected (justification code_not_present), not already_fixed.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2007-1652",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-servlets@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e12698d0-331b-51c2-9fc1-22f98a3d494c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2007-1652 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-servlets."
      }
    },
    {
      "id": "CVE-2023-36479",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-servlets@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:86cebe85-c35b-5af4-9ac0-0854cc3c8b0e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-36479 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-servlets. not_affected \u2014 Jetty 12.0.22 is not affected by CVE-2023-36479. The vulnerable CGI servlet (org.eclipse.jetty.servlets.CGI) was completely removed from Jetty 12 by upstream commit 6ce5a0fbcdf in March 2023, prior to the 12.0.22 release. The CVE explicitly states that in Jetty 12, the CGI servlet \"has been entirely removed.\" Comprehensive searches confirm no CGI servlet code exists in the target repository - o...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-9823",
      "affects": [
        {
          "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-servlets@12.0.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:aae7c246-cd8e-56ca-a3d9-32250fe863cc",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-9823 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-servlets. not_affected \u2014 Target version 12.0.22 is not affected by CVE-2024-9823. The vulnerable session-based request tracking mechanism was removed by upstream Jetty developers (commit 168d8715d4148dafe7f818c4bb01dcd0d6e2347f by Greg Wilkins) before the 12.0.22 release, which TuxCare subsequently onboarded. The DoSFilter now uses only IP-based tracking with scheduled cleanup, eliminating the unbounded memory accumula...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-servlets@12.0.22-tuxcare.1"
    }
  ]
}