{
  "@id": "urn:uuid:a06fda1f-006b-407b-9b17-cf4e828e7a1f",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 26,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T17:54:00.114734+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-deploy@11.0.19-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-deploy@11.0.19-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-02T17:54:00.114734+00:00",
      "status_notes": "Vulnerability CVE-2021-28163 does not affect version 11.0.19-tuxcare.4 of org.eclipse.jetty:jetty-deploy. not_affected \u2014 CVE-2021-28163 is NOT present in the target Jetty 11.0.19. The vulnerability allowed symlinked webapps directories to be deployed as static web applications, exposing directory contents for download. The fix (using Files.isSameFile to properly resolve symlinks when comparing scanned directories against monitored resources) was applied upstream by Greg Wilkins in commit c1ae922ab05 (March 25, 20...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28163"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-28163 is NOT present in the target Jetty 11.0.19. The vulnerability allowed symlinked webapps directories to be deployed as static web applications, exposing directory contents for download. The fix (using Files.isSameFile to properly resolve symlinks when comparing scanned directories against monitored resources) was applied upstream by Greg Wilkins in commit c1ae922ab05 (March 25, 20..."
    }
  ]
}