{
  "@id": "urn:uuid:bee0d325-b7c2-439b-9355-a94a2ef81cab",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 16,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T03:47:09.012068+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.28.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.28.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-27216 does not affect version 10.0.28.tuxcare0002 of org.eclipse.jetty:jetty-webapp. CVE-2020-27216 (temp directory race condition) is NOT present in the target. The upstream Eclipse/Jetty fix (commit 53e0e0e9b25 from Oct 2020) was already included in Jetty 10.0.28 before TuxCare's base. The target uses secure atomic directory creation via Files.createTempDirectory() (lines 104, 236) instead of the vulnerable File.createTempFile() \u2192 delete() \u2192 mkdirs() race pattern.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27216"
      },
      "impact_statement": "CVE-2020-27216 (temp directory race condition) is NOT present in the target. The upstream Eclipse/Jetty fix (commit 53e0e0e9b25 from Oct 2020) was already included in Jetty 10.0.28 before TuxCare's base. The target uses secure atomic directory creation via Files.createTempDirectory() (lines 104, 236) instead of the vulnerable File.createTempFile() \u2192 delete() \u2192 mkdirs() race pattern."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.28.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.28.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-03T03:47:09.012068+00:00",
      "status_notes": "Vulnerability CVE-2021-28164 does not affect version 10.0.28.tuxcare0002 of org.eclipse.jetty:jetty-webapp. not_affected \u2014 CVE-2021-28164 is NOT present in Jetty 10.0.28. The vulnerability allowed attackers to access protected WEB-INF/META-INF resources using percent-encoded dot segments in URIs (e.g., /context/%2e/WEB-INF/web.xml). The fix was introduced by upstream Jetty in version 9.4.37 (February 2021) via commit 20ef71fe5d7 authored by Greg Wilkins. This fix is present in the target: HttpURI.java detects ambig...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28164"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-28164 is NOT present in Jetty 10.0.28. The vulnerability allowed attackers to access protected WEB-INF/META-INF resources using percent-encoded dot segments in URIs (e.g., /context/%2e/WEB-INF/web.xml). The fix was introduced by upstream Jetty in version 9.4.37 (February 2021) via commit 20ef71fe5d7 authored by Greg Wilkins. This fix is present in the target: HttpURI.java detects ambig..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.28.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.28.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-03T03:42:38.974178+00:00",
      "status_notes": "Vulnerability CVE-2021-34429 does not affect version 10.0.28.tuxcare0002 of org.eclipse.jetty:jetty-webapp. not_affected \u2014 CVE-2021-34429 fix is already present in target version 10.0.28. The vulnerability allowed accessing protected resources like WEB-INF via encoded path segments (%u002e, %00). The fix was authored by Lachlan Roberts (lachlan@webtide.com) from upstream Webtide and included in Jetty 10.0.10+. TuxCare's onboarding of version 10.0.26 (commit cf975b23e1f) already contained this upstream fix. All defe...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-34429"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-34429 fix is already present in target version 10.0.28. The vulnerability allowed accessing protected resources like WEB-INF via encoded path segments (%u002e, %00). The fix was authored by Lachlan Roberts (lachlan@webtide.com) from upstream Webtide and included in Jetty 10.0.10+. TuxCare's onboarding of version 10.0.26 (commit cf975b23e1f) already contained this upstream fix. All defe..."
    }
  ]
}