{
  "@id": "urn:uuid:6fa3a98a-eb8a-45a3-8830-5d20b134f379",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 19,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:07:59.808671+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:07:59.808671+00:00",
      "status_notes": "Vulnerability CVE-2020-27216 does not affect version 11.0.28-tuxcare.2 of org.eclipse.jetty:jetty-webapp. CVE-2020-27216 (temporary directory race condition vulnerability) is NOT present in this target. The upstream Jetty project fixed this vulnerability in commits 53e0e0e9b25 and related patches (issue #5451, GHSA-g3wg-6mcf-8jj6) authored by Joakim Erdfelt in October 2020. These fixes were already included in upstream Jetty 11.0.26 before TuxCare onboarded version 11.0.28.tuxcare0005. The vulnerable pattern (File.createTempFile + delete + mkdirs race condition) has been replaced with secure atomic operations: Files.createTempDirectory() for webapp unpacking directories and Files.createTempFile() for multipart uploads, both creating with owner-only permissions on POSIX systems. All fix commits verified in HEAD ancestry and confirmed as upstream work predating TuxCare's first commit (676c95d749 \"setup 11.0.26\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.33.v20201020; >= 10.0.0.beta1, < 10.0.0.beta3; >= 11.0.0.beta1, < 11.0.0.beta3), NVD (>= 1.0, < 9.3.29; >= 9.4.0, <= 9.4.32; = 10.0.0-alpha1; = 10.0.0-beta0; = 10.0.0-beta1; = 10.0.0-beta2; = 11.0.0-alpha1; = 11.0.0-beta1; = 11.0.0-beta2), Snyk (>= 1.0, < 9.4.33.v20201020; >= 10.0.0.alpha1, < 10.0.0.beta3; >= 11.0.0.alpha1, < 11.0.0.beta3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27216"
      },
      "impact_statement": "CVE-2020-27216 (temporary directory race condition vulnerability) is NOT present in this target. The upstream Jetty project fixed this vulnerability in commits 53e0e0e9b25 and related patches (issue #5451, GHSA-g3wg-6mcf-8jj6) authored by Joakim Erdfelt in October 2020. These fixes were already included in upstream Jetty 11.0.26 before TuxCare onboarded version 11.0.28.tuxcare0005. The vulnerable pattern (File.createTempFile + delete + mkdirs race condition) has been replaced with secure atomic operations: Files.createTempDirectory() for webapp unpacking directories and Files.createTempFile() for multipart uploads, both creating with owner-only permissions on POSIX systems. All fix commits verified in HEAD ancestry and confirmed as upstream work predating TuxCare's first commit (676c95d749 \"setup 11.0.26\").\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.33.v20201020; >= 10.0.0.beta1, < 10.0.0.beta3; >= 11.0.0.beta1, < 11.0.0.beta3), NVD (>= 1.0, < 9.3.29; >= 9.4.0, <= 9.4.32; = 10.0.0-alpha1; = 10.0.0-beta0; = 10.0.0-beta1; = 10.0.0-beta2; = 11.0.0-alpha1; = 11.0.0-beta1; = 11.0.0-beta2), Snyk (>= 1.0, < 9.4.33.v20201020; >= 10.0.0.alpha1, < 10.0.0.beta3; >= 11.0.0.alpha1, < 11.0.0.beta3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T03:47:57.828343+00:00",
      "status_notes": "Vulnerability CVE-2021-28164 does not affect version 11.0.28-tuxcare.2 of org.eclipse.jetty:jetty-webapp. not_affected \u2014 CVE-2021-28164 is not present in target Jetty 11.0.28.tuxcare0005. The vulnerability allowed URIs with percent-encoded dot segments (%2e, %2e%2e) to bypass path restrictions and access protected resources like WEB-INF. The upstream fix (commit 20ef71fe5d709a90c2a5698834fff07b9b4e7ad7 by gregw@webtide.com) was already included in upstream release 11.0.26, which TuxCare onboarded via commit 676c9...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28164"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-28164 is not present in target Jetty 11.0.28.tuxcare0005. The vulnerability allowed URIs with percent-encoded dot segments (%2e, %2e%2e) to bypass path restrictions and access protected resources like WEB-INF. The upstream fix (commit 20ef71fe5d709a90c2a5698834fff07b9b4e7ad7 by gregw@webtide.com) was already included in upstream release 11.0.26, which TuxCare onboarded via commit 676c9..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.28-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.28-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T03:42:38.974178+00:00",
      "status_notes": "Vulnerability CVE-2021-34429 does not affect version 11.0.28-tuxcare.2 of org.eclipse.jetty:jetty-webapp. not_affected \u2014 CVE-2021-34429 describes a vulnerability allowing access to protected WEB-INF resources through encoded URI segments (%u002e, %00). The fix was included in upstream Jetty 11.0.6 (commit f045b5a3bad by Simone Bordet). The target repository is at version 11.0.28, which TuxCare onboarded from upstream at version 11.0.26. Since the fix commit (f045b5a3bad) is an ancestor of the first TuxCare commit...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-34429"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-34429 describes a vulnerability allowing access to protected WEB-INF resources through encoded URI segments (%u002e, %00). The fix was included in upstream Jetty 11.0.6 (commit f045b5a3bad by Simone Bordet). The target repository is at version 11.0.28, which TuxCare onboarded from upstream at version 11.0.26. Since the fix commit (f045b5a3bad) is an ancestor of the first TuxCare commit..."
    }
  ]
}