{
  "@id": "urn:uuid:26f3862e-7393-4e09-becc-20c30a8d78ae",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T19:06:27.547498+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T19:06:27.547498+00:00",
      "status_notes": "Vulnerability CVE-2020-27216 does not affect version 11.0.18-tuxcare.2 of org.eclipse.jetty:jetty-webapp. CVE-2020-27216 is not present in Jetty 11.0.18. The vulnerability involved a race condition in temporary directory creation using File.createTempFile() + delete() + mkdirs(). The upstream fix (commit c7ae5b50ab8) replaced this vulnerable pattern with the secure atomic Files.createTempDirectory() method. This fix was already shipped in the upstream 11.0.18 release before TuxCare onboarded it (first TuxCare commit: 68f02af5af3 \"Onboard version 11.0.18\"). The vulnerable code pattern is completely absent from the current codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.33.v20201020; >= 10.0.0.beta1, < 10.0.0.beta3; >= 11.0.0.beta1, < 11.0.0.beta3), NVD (>= 1.0, < 9.3.29; >= 9.4.0, <= 9.4.32; = 10.0.0-alpha1; = 10.0.0-beta0; = 10.0.0-beta1; = 10.0.0-beta2; = 11.0.0-alpha1; = 11.0.0-beta1; = 11.0.0-beta2), Snyk (>= 1.0, < 9.4.33.v20201020; >= 10.0.0.alpha1, < 10.0.0.beta3; >= 11.0.0.alpha1, < 11.0.0.beta3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27216"
      },
      "impact_statement": "CVE-2020-27216 is not present in Jetty 11.0.18. The vulnerability involved a race condition in temporary directory creation using File.createTempFile() + delete() + mkdirs(). The upstream fix (commit c7ae5b50ab8) replaced this vulnerable pattern with the secure atomic Files.createTempDirectory() method. This fix was already shipped in the upstream 11.0.18 release before TuxCare onboarded it (first TuxCare commit: 68f02af5af3 \"Onboard version 11.0.18\"). The vulnerable code pattern is completely absent from the current codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.33.v20201020; >= 10.0.0.beta1, < 10.0.0.beta3; >= 11.0.0.beta1, < 11.0.0.beta3), NVD (>= 1.0, < 9.3.29; >= 9.4.0, <= 9.4.32; = 10.0.0-alpha1; = 10.0.0-beta0; = 10.0.0-beta1; = 10.0.0-beta2; = 11.0.0-alpha1; = 11.0.0-beta1; = 11.0.0-beta2), Snyk (>= 1.0, < 9.4.33.v20201020; >= 10.0.0.alpha1, < 10.0.0.beta3; >= 11.0.0.alpha1, < 11.0.0.beta3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T19:06:27.547498+00:00",
      "status_notes": "Vulnerability CVE-2021-28164 does not affect version 11.0.18-tuxcare.2 of org.eclipse.jetty:jetty-webapp. not_affected \u2014 The target (Jetty 11.0.18) is not affected by CVE-2021-28164 when using the default configuration. The vulnerability allows percent-encoded dots (%2e, %2e%2e) to bypass WEB-INF protection by decoding to unnormalized paths like /./WEB-INF/web.xml. However, the default UriCompliance.DEFAULT mode actively rejects AMBIGUOUS_PATH_SEGMENT violations in Request.setMetaData (lines 1745-1750), blocking ...",
      "vulnerability": {
        "name": "CVE-2021-28164"
      },
      "impact_statement": "not_affected \u2014 The target (Jetty 11.0.18) is not affected by CVE-2021-28164 when using the default configuration. The vulnerability allows percent-encoded dots (%2e, %2e%2e) to bypass WEB-INF protection by decoding to unnormalized paths like /./WEB-INF/web.xml. However, the default UriCompliance.DEFAULT mode actively rejects AMBIGUOUS_PATH_SEGMENT violations in Request.setMetaData (lines 1745-1750), blocking ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T19:06:27.547498+00:00",
      "status_notes": "Vulnerability CVE-2021-34429 does not affect version 11.0.18-tuxcare.2 of org.eclipse.jetty:jetty-webapp. not_affected \u2014 CVE-2021-34429 is NOT present in Jetty 11.0.18-tuxcare.1. The vulnerability was fixed in upstream Jetty 11.0.7 (July 2021) and was already present in the Jetty 11.0.18 release (October 2023) that TuxCare onboarded in September 2026. All three key defenses from the patch are present in the target: (1) null byte rejection in HttpURI parsing, (2) path canonicalization in ServletContext.getResource...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-34429"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-34429 is NOT present in Jetty 11.0.18-tuxcare.1. The vulnerability was fixed in upstream Jetty 11.0.7 (July 2021) and was already present in the Jetty 11.0.18 release (October 2023) that TuxCare onboarded in September 2026. All three key defenses from the patch are present in the target: (1) null byte rejection in HttpURI parsing, (2) path canonicalization in ServletContext.getResource..."
    }
  ]
}