{
  "@id": "urn:uuid:99be6f8b-5122-4bf5-b06d-b59e17a73753",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 16,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T03:47:09.012068+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.27.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.27.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-27216 does not affect version 10.0.27.tuxcare0004 of org.eclipse.jetty:jetty-webapp. Version 10.0.27 is not vulnerable. Summary: The target repository (Jetty 10.0.27) is NOT vulnerable to CVE-2020-27216. The security fix from upstream commit 53e0e0e9b25 (October 15, 2020) has been properly applied, replacing all instances of the vulnerable temp directory creation pattern with the secure Files.createTempDirectory() method. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27216"
      },
      "impact_statement": "Version 10.0.27 is not vulnerable. Summary: The target repository (Jetty 10.0.27) is NOT vulnerable to CVE-2020-27216. The security fix from upstream commit 53e0e0e9b25 (October 15, 2020) has been properly applied, replacing all instances of the vulnerable temp directory creation pattern with the secure Files.createTempDirectory() method. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.27.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.27.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-11-03T03:47:09.012068+00:00",
      "status_notes": "Vulnerability CVE-2021-28164 does not affect version 10.0.27.tuxcare0004 of org.eclipse.jetty:jetty-webapp. not_affected \u2014 CVE-2021-28164: The target Jetty 10.0.27 is NOT AFFECTED. The vulnerable pattern (lack of normalization for percent-encoded dot segments allowing WEB-INF bypass) is not present because upstream Jetty fixed this vulnerability in version 10.0.10 (March 2021), well before TuxCare onboarded version 10.0.27. The fix was authored by Greg Wilkins (gregw@webtide.com) and shipped in the upstream release...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28164"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-28164: The target Jetty 10.0.27 is NOT AFFECTED. The vulnerable pattern (lack of normalization for percent-encoded dot segments allowing WEB-INF bypass) is not present because upstream Jetty fixed this vulnerability in version 10.0.10 (March 2021), well before TuxCare onboarded version 10.0.27. The fix was authored by Greg Wilkins (gregw@webtide.com) and shipped in the upstream release..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.27.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.27.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-11-03T03:42:02.973774+00:00",
      "status_notes": "Vulnerability CVE-2021-34429 does not affect version 10.0.27.tuxcare0004 of org.eclipse.jetty:jetty-webapp. not_affected \u2014 CVE-2021-34429 is NOT present in this target. The vulnerability allowed attackers to access protected WEB-INF resources using encoded URI characters (%u002e, %00). The upstream Jetty project fixed this in commits f045b5a3bad and 3c32afa05c5, which were already included in the upstream release that TuxCare onboarded (10.0.26 or earlier). The target at version 10.0.27.tuxcare0004 contains all the...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-34429"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-34429 is NOT present in this target. The vulnerability allowed attackers to access protected WEB-INF resources using encoded URI characters (%u002e, %00). The upstream Jetty project fixed this in commits f045b5a3bad and 3c32afa05c5, which were already included in the upstream release that TuxCare onboarded (10.0.26 or earlier). The target at version 10.0.27.tuxcare0004 contains all the..."
    }
  ]
}