{
  "@id": "urn:uuid:5b9614c8-1e7f-4ce6-bcfd-73db32c73902",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 28,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:04:11.456857+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@9.0.24-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-jasper@9.0.24-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:04:11.456857+00:00",
      "status_notes": "Vulnerability CVE-2016-5018 does not affect version 9.0.24-tuxcare.1 of org.apache.tomcat.embed:tomcat-embed-jasper. CVE-2016-5018 affects Tomcat 9.0.0.M1 to 9.0.0.M9 via a SecurityManager bypass in JspRuntimeLibrary.introspecthelper(). The vulnerability allowed malicious web applications to execute privileged operations by invoking a Tomcat utility method that wrapped introspection logic in AccessController.doPrivileged(). The target version 9.0.24 is NOT AFFECTED because the vulnerable code pattern (PrivilegedIntrospectHelper class, IS_SECURITY_ENABLED check, doPrivileged wrapper) was removed by upstream Apache Tomcat in August 2016 (commit a6b1ebc246 by Mark Thomas). This fix shipped in the upstream 9.0.24 release before TuxCare onboarded it (commit 9c7e71d9ac, Sep 2019). The current introspecthelper method (lines 302-373) executes introspection directly with the caller's permissions, not with elevated privileges.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0RC1, < 8.0.37; >= 7.0.0, < 7.0.72; >= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0RC1, < 8.0.37; >= 7.0.0, < 7.0.72; >= 6.0.0, < 6.0.47), NVD (>= 6.0.0, <= 6.0.45; >= 7.0.0, <= 7.0.70; >= 8.0, <= 8.0.36; >= 8.5.0, <= 8.5.4; = 9.0.0-milestone1; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M9; >= 8.5.0, <= 8.5.4; >= 8.0.0.RC1, <= 8.0.36; >= 7.0.0, <= 7.0.70; >= 6.0.0, <= 6.0.45), Snyk (>= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5018"
      },
      "impact_statement": "CVE-2016-5018 affects Tomcat 9.0.0.M1 to 9.0.0.M9 via a SecurityManager bypass in JspRuntimeLibrary.introspecthelper(). The vulnerability allowed malicious web applications to execute privileged operations by invoking a Tomcat utility method that wrapped introspection logic in AccessController.doPrivileged(). The target version 9.0.24 is NOT AFFECTED because the vulnerable code pattern (PrivilegedIntrospectHelper class, IS_SECURITY_ENABLED check, doPrivileged wrapper) was removed by upstream Apache Tomcat in August 2016 (commit a6b1ebc246 by Mark Thomas). This fix shipped in the upstream 9.0.24 release before TuxCare onboarded it (commit 9c7e71d9ac, Sep 2019). The current introspecthelper method (lines 302-373) executes introspection directly with the caller's permissions, not with elevated privileges.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0RC1, < 8.0.37; >= 7.0.0, < 7.0.72; >= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0RC1, < 8.0.37; >= 7.0.0, < 7.0.72; >= 6.0.0, < 6.0.47), NVD (>= 6.0.0, <= 6.0.45; >= 7.0.0, <= 7.0.70; >= 8.0, <= 8.0.36; >= 8.5.0, <= 8.5.4; = 9.0.0-milestone1; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M9; >= 8.5.0, <= 8.5.4; >= 8.0.0.RC1, <= 8.0.36; >= 7.0.0, <= 7.0.70; >= 6.0.0, <= 6.0.45), Snyk (>= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10)."
    }
  ]
}