{
  "@id": "urn:uuid:6935af34-74c6-4d39-94de-6380baa54bf9",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 14,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T17:52:00.141527+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-deploy@11.0.29.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-deploy@11.0.29.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-11-02T17:52:00.141527+00:00",
      "status_notes": "Vulnerability CVE-2021-28163 does not affect version 11.0.29.tuxcare0004 of org.eclipse.jetty:jetty-deploy. not_affected \u2014 CVE-2021-28163 is NOT present in Jetty 11.0.29. The vulnerability allowed symlinked deployment directories to be deployed as static web applications, exposing their contents. The upstream fix (commit 37fffb17226) replaced path equality checks with Files.isSameFile() comparisons, correctly identifying when deployment candidates refer to the monitoring directory even through symlinks. This fix wa...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28163"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-28163 is NOT present in Jetty 11.0.29. The vulnerability allowed symlinked deployment directories to be deployed as static web applications, exposing their contents. The upstream fix (commit 37fffb17226) replaced path equality checks with Files.isSameFile() comparisons, correctly identifying when deployment candidates refer to the monitoring directory even through symlinks. This fix wa..."
    }
  ]
}