{
  "@id": "urn:uuid:697ae9c0-a2f6-4c0e-b9c0-7093d7d017c1",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T19:06:27.547498+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-deploy@11.0.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-deploy@11.0.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T19:06:27.547498+00:00",
      "status_notes": "Vulnerability CVE-2021-28163 does not affect version 11.0.18-tuxcare.2 of org.eclipse.jetty:jetty-deploy. not_affected \u2014 Target Jetty 11.0.18 is NOT affected by CVE-2021-28163. The vulnerability pattern (symlink-based deployment of monitored directories) is not present because the upstream fix was already included in the Jetty 11.0.18 release that TuxCare onboarded. The fix uses Files.isSameFile() in PathResource.isSame() to correctly identify symlinked paths, preventing the monitored webapps directory from being...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28163"
      },
      "impact_statement": "not_affected \u2014 Target Jetty 11.0.18 is NOT affected by CVE-2021-28163. The vulnerability pattern (symlink-based deployment of monitored directories) is not present because the upstream fix was already included in the Jetty 11.0.18 release that TuxCare onboarded. The fix uses Files.isSameFile() in PathResource.isSame() to correctly identify symlinked paths, preventing the monitored webapps directory from being..."
    }
  ]
}