{
  "@id": "urn:uuid:d7ee2a22-e3ba-4115-bc2d-865d48828934",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 13,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T17:54:00.114734+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-deploy@9.4.64.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-deploy@9.4.64.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-02T17:54:00.114734+00:00",
      "status_notes": "Vulnerability CVE-2021-28163 does not affect version 9.4.64.tuxcare0001 of org.eclipse.jetty:jetty-deploy. not_affected \u2014 CVE-2021-28163 is not present in the target. The vulnerability allowed symlinked webapps directories to be deployed as static web applications, exposing directory contents. The fix was shipped in upstream Jetty 9.4.39 (March 2021) and is present in the target at 9.4.64. The fix uses Files.isSameFile() to properly handle symlink comparison in WebAppProvider.Filter.accept(), preventing the monito...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28163"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-28163 is not present in the target. The vulnerability allowed symlinked webapps directories to be deployed as static web applications, exposing directory contents. The fix was shipped in upstream Jetty 9.4.39 (March 2021) and is present in the target at 9.4.64. The fix uses Files.isSameFile() to properly handle symlink comparison in WebAppProvider.Filter.accept(), preventing the monito..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-deploy@9.4.64.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-deploy@9.4.64.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-12611 is fixed in version 9.4.64.tuxcare0001 of org.eclipse.jetty:jetty-deploy.",
      "vulnerability": {
        "name": "CVE-2026-12611"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-deploy@9.4.64.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-deploy@9.4.64.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-19203 is fixed in version 9.4.64.tuxcare0001 of org.eclipse.jetty:jetty-deploy.",
      "vulnerability": {
        "name": "CVE-2026-19203"
      }
    }
  ]
}