{
  "@id": "urn:uuid:c41729d9-853c-4e28-86c3-a6be69a57654",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 19,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:07:59.808671+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.27.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.27.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-04T09:07:59.808671+00:00",
      "status_notes": "Vulnerability CVE-2020-27216 does not affect version 11.0.27.tuxcare0002 of org.eclipse.jetty:jetty-webapp. CVE-2020-27216 describes a race condition vulnerability in temporary directory creation where an attacker could win a race between File.delete() and mkdirs() to control the webapp's temporary directory. The target repository version 11.0.27 is NOT affected because the vulnerable code pattern has been replaced with the secure Files.createTempDirectory() API, which creates directories atomically. This fix (commit 53e0e0e9b25) was authored by upstream developer Joakim Erdfelt and was already present in the upstream release before TuxCare onboarded version 11.0.26.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.33.v20201020; >= 10.0.0.beta1, < 10.0.0.beta3; >= 11.0.0.beta1, < 11.0.0.beta3), NVD (>= 1.0, < 9.3.29; >= 9.4.0, <= 9.4.32; = 10.0.0-alpha1; = 10.0.0-beta0; = 10.0.0-beta1; = 10.0.0-beta2; = 11.0.0-alpha1; = 11.0.0-beta1; = 11.0.0-beta2), Snyk (>= 1.0, < 9.4.33.v20201020; >= 10.0.0.alpha1, < 10.0.0.beta3; >= 11.0.0.alpha1, < 11.0.0.beta3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27216"
      },
      "impact_statement": "CVE-2020-27216 describes a race condition vulnerability in temporary directory creation where an attacker could win a race between File.delete() and mkdirs() to control the webapp's temporary directory. The target repository version 11.0.27 is NOT affected because the vulnerable code pattern has been replaced with the secure Files.createTempDirectory() API, which creates directories atomically. This fix (commit 53e0e0e9b25) was authored by upstream developer Joakim Erdfelt and was already present in the upstream release before TuxCare onboarded version 11.0.26.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.33.v20201020; >= 10.0.0.beta1, < 10.0.0.beta3; >= 11.0.0.beta1, < 11.0.0.beta3), NVD (>= 1.0, < 9.3.29; >= 9.4.0, <= 9.4.32; = 10.0.0-alpha1; = 10.0.0-beta0; = 10.0.0-beta1; = 10.0.0-beta2; = 11.0.0-alpha1; = 11.0.0-beta1; = 11.0.0-beta2), Snyk (>= 1.0, < 9.4.33.v20201020; >= 10.0.0.alpha1, < 10.0.0.beta3; >= 11.0.0.alpha1, < 11.0.0.beta3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.27.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.27.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-03T03:47:09.012068+00:00",
      "status_notes": "Vulnerability CVE-2021-28164 does not affect version 11.0.27.tuxcare0002 of org.eclipse.jetty:jetty-webapp. not_affected \u2014 CVE-2021-28164 is NOT present in the target (Jetty 11.0.27). The vulnerability allowed path traversal to protected resources via percent-encoded dot segments (%2e, %2e%2e). The upstream fix (commit e412c8a15b3) was shipped in Jetty 11.0.26 and is present in this version. The fix ensures that HttpURI.getDecodedPath() ALWAYS normalizes paths via URIUtil.canonicalPath(), removing . and .. segments...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28164"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-28164 is NOT present in the target (Jetty 11.0.27). The vulnerability allowed path traversal to protected resources via percent-encoded dot segments (%2e, %2e%2e). The upstream fix (commit e412c8a15b3) was shipped in Jetty 11.0.26 and is present in this version. The fix ensures that HttpURI.getDecodedPath() ALWAYS normalizes paths via URIUtil.canonicalPath(), removing . and .. segments..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.27.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.27.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-11-03T03:42:02.973774+00:00",
      "status_notes": "Vulnerability CVE-2021-34429 does not affect version 11.0.27.tuxcare0002 of org.eclipse.jetty:jetty-webapp. not_affected \u2014 CVE-2021-34429 is NOT present in target Jetty 11.0.27. The vulnerability allowed crafted URIs with encoded characters (%u002e, %00) to access protected WEB-INF resources. The upstream fix (commit f045b5a3bad) was authored by Simone Bordet and shipped in upstream Jetty 11.0.6 (released June 2021). TuxCare onboarded version 11.0.26+ which already contained this fix. All defense mechanisms are ver...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-34429"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-34429 is NOT present in target Jetty 11.0.27. The vulnerability allowed crafted URIs with encoded characters (%u002e, %00) to access protected WEB-INF resources. The upstream fix (commit f045b5a3bad) was authored by Simone Bordet and shipped in upstream Jetty 11.0.6 (released June 2021). TuxCare onboarded version 11.0.26+ which already contained this fix. All defense mechanisms are ver..."
    }
  ]
}