{
  "@id": "urn:uuid:894f2cdc-08da-4f38-a073-593839228f14",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 38,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:04:11.456857+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@10.1.33-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@10.1.33-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:04:11.456857+00:00",
      "status_notes": "Vulnerability CVE-2016-5018 does not affect version 10.1.33-tuxcare.2 of org.apache.tomcat.embed:tomcat-embed-jasper. CVE-2016-5018 describes a SecurityManager bypass via a JSP utility method accessible to web applications. The vulnerability existed in JspRuntimeLibrary.introspecthelper() which used AccessController.doPrivileged() to execute operations with elevated privileges. Apache Tomcat fixed this in commit a6b1ebc246 (2016-08-01) by removing the PrivilegedIntrospectHelper class and the privilege escalation wrapper. This upstream fix was already present in Tomcat 10.1.33 when TuxCare onboarded the version (commit 47a79a9e4c, 2026-10-07). The target repository contains the fixed code with no privilege escalation mechanism.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0RC1, < 8.0.37; >= 7.0.0, < 7.0.72; >= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0RC1, < 8.0.37; >= 7.0.0, < 7.0.72; >= 6.0.0, < 6.0.47), NVD (>= 6.0.0, <= 6.0.45; >= 7.0.0, <= 7.0.70; >= 8.0, <= 8.0.36; >= 8.5.0, <= 8.5.4; = 9.0.0-milestone1; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M9; >= 8.5.0, <= 8.5.4; >= 8.0.0.RC1, <= 8.0.36; >= 7.0.0, <= 7.0.70; >= 6.0.0, <= 6.0.45), Snyk (>= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5018"
      },
      "impact_statement": "CVE-2016-5018 describes a SecurityManager bypass via a JSP utility method accessible to web applications. The vulnerability existed in JspRuntimeLibrary.introspecthelper() which used AccessController.doPrivileged() to execute operations with elevated privileges. Apache Tomcat fixed this in commit a6b1ebc246 (2016-08-01) by removing the PrivilegedIntrospectHelper class and the privilege escalation wrapper. This upstream fix was already present in Tomcat 10.1.33 when TuxCare onboarded the version (commit 47a79a9e4c, 2026-10-07). The target repository contains the fixed code with no privilege escalation mechanism.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0RC1, < 8.0.37; >= 7.0.0, < 7.0.72; >= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0RC1, < 8.0.37; >= 7.0.0, < 7.0.72; >= 6.0.0, < 6.0.47), NVD (>= 6.0.0, <= 6.0.45; >= 7.0.0, <= 7.0.70; >= 8.0, <= 8.0.36; >= 8.5.0, <= 8.5.4; = 9.0.0-milestone1; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M9; >= 8.5.0, <= 8.5.4; >= 8.0.0.RC1, <= 8.0.36; >= 7.0.0, <= 7.0.70; >= 6.0.0, <= 6.0.45), Snyk (>= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10)."
    }
  ]
}