{
  "@id": "urn:uuid:f723b446-7458-4d03-beb0-70930dfcd5d4",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 15,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T03:49:12.045760+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.30.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.30.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-27216 does not affect version 10.0.30.tuxcare0002 of org.eclipse.jetty:jetty-webapp. Version 10.0.29 is not vulnerable. Summary: CVE-2020-27216 has been fixed in this repository. The target is running Jetty 10.0.29, which is well after the affected version range (10.0.0.alpha1 through 10.0.0.beta2). The vulnerable temporary directory creation pattern using File.createTempFile() followed by delete() and mkdirs() has been replaced with the secure Files.createTempDirectory() method, which provides atomic creation with restrictive permissions (0700 on Unix). [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27216"
      },
      "impact_statement": "Version 10.0.29 is not vulnerable. Summary: CVE-2020-27216 has been fixed in this repository. The target is running Jetty 10.0.29, which is well after the affected version range (10.0.0.alpha1 through 10.0.0.beta2). The vulnerable temporary directory creation pattern using File.createTempFile() followed by delete() and mkdirs() has been replaced with the secure Files.createTempDirectory() method, which provides atomic creation with restrictive permissions (0700 on Unix). [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.30.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.30.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-03T03:49:12.045760+00:00",
      "status_notes": "Vulnerability CVE-2021-28164 does not affect version 10.0.30.tuxcare0002 of org.eclipse.jetty:jetty-webapp. not_affected \u2014 The target (Jetty 10.0.30.tuxcare0002) is NOT vulnerable to CVE-2021-28164. The fix for this vulnerability was already present in the upstream Jetty 10.0.26 release that TuxCare onboarded. The fix includes: (1) Detection of ambiguous path segments (e.g., %2e, %2e%2e) via the AMBIGUOUS_PATH_SEGMENT violation in HttpURI.java, (2) DEFAULT UriCompliance mode that rejects such violations, (3) Enforc...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28164"
      },
      "impact_statement": "not_affected \u2014 The target (Jetty 10.0.30.tuxcare0002) is NOT vulnerable to CVE-2021-28164. The fix for this vulnerability was already present in the upstream Jetty 10.0.26 release that TuxCare onboarded. The fix includes: (1) Detection of ambiguous path segments (e.g., %2e, %2e%2e) via the AMBIGUOUS_PATH_SEGMENT violation in HttpURI.java, (2) DEFAULT UriCompliance mode that rejects such violations, (3) Enforc..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.30.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.30.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-03T03:43:13.749002+00:00",
      "status_notes": "Vulnerability CVE-2021-34429 does not affect version 10.0.30.tuxcare0002 of org.eclipse.jetty:jetty-webapp. not_affected \u2014 The target Jetty 10.0.30 is not affected by CVE-2021-34429. The vulnerability was fixed by upstream commit 3c32afa05c5 (Issue #6473) authored by lachlan@webtide.com on 2021-06-29, which predates TuxCare's onboarding of version 10.0.26 on 2025-12-12. The fix was already present in the upstream release that TuxCare adopted. The fix implements multiple defense layers: (1) HttpURI parsing rejects n...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-34429"
      },
      "impact_statement": "not_affected \u2014 The target Jetty 10.0.30 is not affected by CVE-2021-34429. The vulnerability was fixed by upstream commit 3c32afa05c5 (Issue #6473) authored by lachlan@webtide.com on 2021-06-29, which predates TuxCare's onboarding of version 10.0.26 on 2025-12-12. The fix was already present in the upstream release that TuxCare adopted. The fix implements multiple defense layers: (1) HttpURI parsing rejects n..."
    }
  ]
}