{
  "@id": "urn:uuid:dfa9e82f-adbc-46c2-a378-efdedea77112",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 16,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T03:50:05.723844+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.29.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.29.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-27216 does not affect version 10.0.29.tuxcare0001 of org.eclipse.jetty:jetty-webapp. Version 10.0.29 is not vulnerable. Summary: CVE-2020-27216 has been fixed in this repository. The target is running Jetty 10.0.29, which is well after the affected version range (10.0.0.alpha1 through 10.0.0.beta2). The vulnerable temporary directory creation pattern using File.createTempFile() followed by delete() and mkdirs() has been replaced with the secure Files.createTempDirectory() method, which provides atomic creation with restrictive permissions (0700 on Unix). [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27216"
      },
      "impact_statement": "Version 10.0.29 is not vulnerable. Summary: CVE-2020-27216 has been fixed in this repository. The target is running Jetty 10.0.29, which is well after the affected version range (10.0.0.alpha1 through 10.0.0.beta2). The vulnerable temporary directory creation pattern using File.createTempFile() followed by delete() and mkdirs() has been replaced with the secure Files.createTempDirectory() method, which provides atomic creation with restrictive permissions (0700 on Unix). [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.29.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.29.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T03:50:05.723844+00:00",
      "status_notes": "Vulnerability CVE-2021-28164 does not affect version 10.0.29.tuxcare0001 of org.eclipse.jetty:jetty-webapp. not_affected \u2014 CVE-2021-28164 is NOT present in target Jetty 10.0.29.tuxcare0003. The vulnerability (URI path traversal via %2e/%2e%2e encoded segments to access WEB-INF resources) was fixed in upstream Jetty 10.0.2 (March 2021) by introducing UriCompliance modes that detect and reject ambiguous path segments. The target contains the complete fix: HttpURI.java detects %2e/%2e%2e as AMBIGUOUS_PATH_SEGMENT viol...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28164"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-28164 is NOT present in target Jetty 10.0.29.tuxcare0003. The vulnerability (URI path traversal via %2e/%2e%2e encoded segments to access WEB-INF resources) was fixed in upstream Jetty 10.0.2 (March 2021) by introducing UriCompliance modes that detect and reject ambiguous path segments. The target contains the complete fix: HttpURI.java detects %2e/%2e%2e as AMBIGUOUS_PATH_SEGMENT viol..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.29.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.29.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T03:42:38.974178+00:00",
      "status_notes": "Vulnerability CVE-2021-34429 does not affect version 10.0.29.tuxcare0001 of org.eclipse.jetty:jetty-webapp. not_affected \u2014 The target Jetty version 10.0.29.tuxcare0003 is NOT affected by CVE-2021-34429. All defenses from the upstream security patches (commits f045b5a3bad and related) are present in the codebase. The fix was authored by the upstream Jetty project (simone.bordet@gmail.com) and shipped in the base upstream release before TuxCare onboarded version 10.0.26. The vulnerable pattern allowing encoded URI se...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-34429"
      },
      "impact_statement": "not_affected \u2014 The target Jetty version 10.0.29.tuxcare0003 is NOT affected by CVE-2021-34429. All defenses from the upstream security patches (commits f045b5a3bad and related) are present in the codebase. The fix was authored by the upstream Jetty project (simone.bordet@gmail.com) and shipped in the base upstream release before TuxCare onboarded version 10.0.26. The vulnerable pattern allowing encoded URI se..."
    }
  ]
}