{
  "@id": "urn:uuid:c37d8b57-10db-4fc1-a021-782273088c72",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 6,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T16:29:48.390816+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2020-27216 does not affect version 11.0.34.tuxcare0001 of org.eclipse.jetty:jetty-webapp. CVE-2020-27216 describes a local privilege escalation vulnerability via race condition in temporary directory creation. The vulnerable pattern (File.createTempFile() -> delete() -> mkdirs()) is NOT present in the target Jetty 11.0.34. The upstream fix (commit 53e0e0e9b25) replaced this pattern with the secure Files.createTempDirectory() method, which creates directories atomically with user-only permissions. This fix was already included in upstream Jetty 11.0.0.beta3 (per CVE advisory) and was present in the upstream Jetty 11.0.26 release that TuxCare onboarded. The target code at jetty-webapp/src/main/java/org/eclipse/jetty/webapp/WebInfConfiguration.java:242 uses the secure implementation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.33.v20201020; >= 10.0.0.beta1, < 10.0.0.beta3; >= 11.0.0.beta1, < 11.0.0.beta3), NVD (>= 1.0, < 9.3.29; >= 9.4.0, <= 9.4.32; = 10.0.0-alpha1; = 10.0.0-beta0; = 10.0.0-beta1; = 10.0.0-beta2; = 11.0.0-alpha1; = 11.0.0-beta1; = 11.0.0-beta2), Snyk (>= 1.0, < 9.4.33.v20201020; >= 10.0.0.alpha1, < 10.0.0.beta3; >= 11.0.0.alpha1, < 11.0.0.beta3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27216"
      },
      "impact_statement": "CVE-2020-27216 describes a local privilege escalation vulnerability via race condition in temporary directory creation. The vulnerable pattern (File.createTempFile() -> delete() -> mkdirs()) is NOT present in the target Jetty 11.0.34. The upstream fix (commit 53e0e0e9b25) replaced this pattern with the secure Files.createTempDirectory() method, which creates directories atomically with user-only permissions. This fix was already included in upstream Jetty 11.0.0.beta3 (per CVE advisory) and was present in the upstream Jetty 11.0.26 release that TuxCare onboarded. The target code at jetty-webapp/src/main/java/org/eclipse/jetty/webapp/WebInfConfiguration.java:242 uses the secure implementation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 9.4.33.v20201020; >= 10.0.0.beta1, < 10.0.0.beta3; >= 11.0.0.beta1, < 11.0.0.beta3), NVD (>= 1.0, < 9.3.29; >= 9.4.0, <= 9.4.32; = 10.0.0-alpha1; = 10.0.0-beta0; = 10.0.0-beta1; = 10.0.0-beta2; = 11.0.0-alpha1; = 11.0.0-beta1; = 11.0.0-beta2), Snyk (>= 1.0, < 9.4.33.v20201020; >= 10.0.0.alpha1, < 10.0.0.beta3; >= 11.0.0.alpha1, < 11.0.0.beta3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T14:59:50.015654+00:00",
      "status_notes": "Vulnerability CVE-2021-28164 does not affect version 11.0.34.tuxcare0001 of org.eclipse.jetty:jetty-webapp. not_affected \u2014 CVE-2021-28164 affects Jetty's URI parsing, allowing access to protected WEB-INF directories via percent-encoded dot segments (e.g., /context/%2e/WEB-INF/web.xml). The target Jetty 11.0.34.tuxcare0001 includes the complete fix from upstream Jetty 11.0.1, released February 2021. The fix detects ambiguous URI segments (%2e, %2e%2e) during parsing, flags them as violations, and rejects them with H...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28164"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-28164 affects Jetty's URI parsing, allowing access to protected WEB-INF directories via percent-encoded dot segments (e.g., /context/%2e/WEB-INF/web.xml). The target Jetty 11.0.34.tuxcare0001 includes the complete fix from upstream Jetty 11.0.1, released February 2021. The fix detects ambiguous URI segments (%2e, %2e%2e) during parsing, flags them as violations, and rejects them with H..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T15:20:29.978023+00:00",
      "status_notes": "Vulnerability CVE-2021-34429 does not affect version 11.0.34.tuxcare0001 of org.eclipse.jetty:jetty-webapp. not_affected \u2014 CVE-2021-34429 is NOT present in Jetty 11.0.34. The vulnerability allowed crafted URIs using UTF-16 encoding (%u002e) or null bytes (%00) to access protected WEB-INF resources. The fix was introduced by upstream Eclipse Jetty in versions 9.4.43, 10.0.6, and 11.0.6 (June 2021). The target version 11.0.34 is substantially newer and contains all required defenses: (1) null byte rejection in HttpUR...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-34429"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-34429 is NOT present in Jetty 11.0.34. The vulnerability allowed crafted URIs using UTF-16 encoding (%u002e) or null bytes (%00) to access protected WEB-INF resources. The fix was introduced by upstream Eclipse Jetty in versions 9.4.43, 10.0.6, and 11.0.6 (June 2021). The target version 11.0.34 is substantially newer and contains all required defenses: (1) null byte rejection in HttpUR..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T19:04:41.632189+00:00",
      "status_notes": "Vulnerability CVE-2026-12611 is fixed in version 11.0.34.tuxcare0001 of org.eclipse.jetty:jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2026-12611"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T19:04:41.632189+00:00",
      "status_notes": "Vulnerability CVE-2026-19203 is fixed in version 11.0.34.tuxcare0001 of org.eclipse.jetty:jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2026-19203"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T19:04:41.632189+00:00",
      "status_notes": "Vulnerability CVE-2026-19204 is fixed in version 11.0.34.tuxcare0001 of org.eclipse.jetty:jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2026-19204"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T19:04:41.632189+00:00",
      "status_notes": "Vulnerability CVE-2026-76182 is fixed in version 11.0.34.tuxcare0001 of org.eclipse.jetty:jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2026-76182"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T19:04:41.632189+00:00",
      "status_notes": "Vulnerability CVE-2026-76184 is fixed in version 11.0.34.tuxcare0001 of org.eclipse.jetty:jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2026-76184"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T19:04:41.632189+00:00",
      "status_notes": "Vulnerability CVE-2026-77711 is fixed in version 11.0.34.tuxcare0001 of org.eclipse.jetty:jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2026-77711"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.34.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@11.0.34.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-10-30T19:05:00.113792+00:00",
      "status_notes": "Vulnerability CVE-2026-95533 is fixed in version 11.0.34.tuxcare0001 of org.eclipse.jetty:jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2026-95533"
      }
    }
  ]
}