{
  "@id": "urn:uuid:54b2e522-8e41-405f-acec-5631cf1a6e65",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T15:49:32.960958+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.59.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.59.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-11-09T15:49:32.960958+00:00",
      "status_notes": "Vulnerability CVE-2020-27216 does not affect version 9.4.59.tuxcare0004 of org.eclipse.jetty:jetty-webapp. Version 9.4.59 is NOT vulnerable to CVE-2020-27216. The vulnerability was fixed in version 9.4.33.v20201020 (October 2020), and 9.4.59 is well beyond that release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27216"
      },
      "impact_statement": "Version 9.4.59 is NOT vulnerable to CVE-2020-27216. The vulnerability was fixed in version 9.4.33.v20201020 (October 2020), and 9.4.59 is well beyond that release."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.59.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.59.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-11-09T15:49:32.960958+00:00",
      "status_notes": "Vulnerability CVE-2021-28164 does not affect version 9.4.59.tuxcare0004 of org.eclipse.jetty:jetty-webapp. not_affected \u2014 CVE-2021-28164 path traversal vulnerability via percent-encoded dots is NOT present in target version 9.4.59. The upstream vendor fix (commit e412c8a15b3, authored by gregw@webtide.com, released in Jetty 9.4.39) was already included in the upstream 9.4.59 release that TuxCare onboarded. The fix ensures that URIs containing encoded dot segments (like /%2e/WEB-INF/web.xml) are properly normalized...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28164"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-28164 path traversal vulnerability via percent-encoded dots is NOT present in target version 9.4.59. The upstream vendor fix (commit e412c8a15b3, authored by gregw@webtide.com, released in Jetty 9.4.39) was already included in the upstream 9.4.59 release that TuxCare onboarded. The fix ensures that URIs containing encoded dot segments (like /%2e/WEB-INF/web.xml) are properly normalized..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.59.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.59.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-11-09T15:49:32.960958+00:00",
      "status_notes": "Vulnerability CVE-2021-34429 does not affect version 9.4.59.tuxcare0004 of org.eclipse.jetty:jetty-webapp. not_affected \u2014 Target version 9.4.59.tuxcare0003 is NOT AFFECTED by CVE-2021-34429. The vulnerability allowed attackers to use encoded URI characters (%u002e, %00) to bypass path normalization and access protected WEB-INF resources. The upstream Jetty project fixed this in version 9.4.43 (released June 30, 2021) by adding canonicalization checks in ServletContext API methods, null byte detection in URI parsin...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-34429"
      },
      "impact_statement": "not_affected \u2014 Target version 9.4.59.tuxcare0003 is NOT AFFECTED by CVE-2021-34429. The vulnerability allowed attackers to use encoded URI characters (%u002e, %00) to bypass path normalization and access protected WEB-INF resources. The upstream Jetty project fixed this in version 9.4.43 (released June 30, 2021) by adding canonicalization checks in ServletContext API methods, null byte detection in URI parsin..."
    }
  ]
}