{
  "@id": "urn:uuid:8ae951d8-5b01-462c-99ae-ba8107b39081",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T17:09:46.458047+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.60.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.60.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-11-09T17:09:46.458047+00:00",
      "status_notes": "Vulnerability CVE-2020-27216 does not affect version 9.4.60.tuxcare0004 of org.eclipse.jetty:jetty-webapp. Version 9.4.60 is not vulnerable. Summary: The target repository at version 9.4.60 is NOT vulnerable to CVE-2020-27216. The vulnerability was a race condition in temporary directory creation that could lead to local privilege escalation on Unix-like systems. The fix was introduced in version 9.4.33.v20201020 (released October 20, 2020) by replacing the vulnerable File.createTempFile() + delete() + mkdir() pattern with the secure Files.createTempDirectory() method. The current [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27216"
      },
      "impact_statement": "Version 9.4.60 is not vulnerable. Summary: The target repository at version 9.4.60 is NOT vulnerable to CVE-2020-27216. The vulnerability was a race condition in temporary directory creation that could lead to local privilege escalation on Unix-like systems. The fix was introduced in version 9.4.33.v20201020 (released October 20, 2020) by replacing the vulnerable File.createTempFile() + delete() + mkdir() pattern with the secure Files.createTempDirectory() method. The current [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.60.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.60.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-11-09T17:09:46.458047+00:00",
      "status_notes": "Vulnerability CVE-2021-28164 does not affect version 9.4.60.tuxcare0004 of org.eclipse.jetty:jetty-webapp. not_affected \u2014 CVE-2021-28164 is NOT present in Jetty 9.4.60. The vulnerability allowed path traversal via percent-encoded dot segments (e.g., /context/%2e/WEB-INF/web.xml) to access protected resources. The fix was authored by upstream developer Greg Wilkins (gregw@webtide.com) and shipped in Jetty 9.4.40 (April 2021) via commit e412c8a15b3. The target version 9.4.60 includes this upstream fix, which adds de...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28164"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-28164 is NOT present in Jetty 9.4.60. The vulnerability allowed path traversal via percent-encoded dot segments (e.g., /context/%2e/WEB-INF/web.xml) to access protected resources. The fix was authored by upstream developer Greg Wilkins (gregw@webtide.com) and shipped in Jetty 9.4.40 (April 2021) via commit e412c8a15b3. The target version 9.4.60 includes this upstream fix, which adds de..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.60.tuxcare0004",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.60.tuxcare0004"
          }
        }
      ],
      "timestamp": "2026-11-09T17:09:46.458047+00:00",
      "status_notes": "Vulnerability CVE-2021-34429 does not affect version 9.4.60.tuxcare0004 of org.eclipse.jetty:jetty-webapp. not_affected \u2014 The target (Jetty 9.4.60) is not affected by CVE-2021-34429. The upstream vendor's fix (commit f045b5a3bad) for this URI normalization vulnerability was already included in release 9.4.58.1, which TuxCare onboarded as the base version. All defense mechanisms are present: null byte rejection in URI parsing, canonicalization before resource lookup in ServletContext methods, path traversal validat...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-34429"
      },
      "impact_statement": "not_affected \u2014 The target (Jetty 9.4.60) is not affected by CVE-2021-34429. The upstream vendor's fix (commit f045b5a3bad) for this URI normalization vulnerability was already included in release 9.4.58.1, which TuxCare onboarded as the base version. All defense mechanisms are present: null byte rejection in URI parsing, canonicalization before resource lookup in ServletContext methods, path traversal validat..."
    }
  ]
}