{
  "@id": "urn:uuid:a41dd204-e09e-497f-94e6-c27ca71e998d",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 15,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T04:17:33.879237+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.63.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.63.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-27216 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty:jetty-webapp. Jetty 9.4.63 does not contain the vulnerable temporary directory creation pattern (File.createTempFile + delete + mkdir race condition) that CVE-2020-27216 describes; it is absent from the codebase. In jetty-webapp, WebInfConfiguration.makeTempDirectory and cloneConfigure both create the webapp temporary directory with java.nio.file.Files.createTempDirectory, which creates it atomically with owner-only permissions and leaves no window for a local user on a shared /tmp to hijack the directory into which the war and its WEB-INF/lib jars are unpacked. The fix was applied by the upstream Jetty vendor in 9.4.33.v20201020 (October 2020), and this version inherits it from upstream.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27216"
      },
      "impact_statement": "Jetty 9.4.63 does not contain the vulnerable temporary directory creation pattern (File.createTempFile + delete + mkdir race condition) that CVE-2020-27216 describes; it is absent from the codebase. In jetty-webapp, WebInfConfiguration.makeTempDirectory and cloneConfigure both create the webapp temporary directory with java.nio.file.Files.createTempDirectory, which creates it atomically with owner-only permissions and leaves no window for a local user on a shared /tmp to hijack the directory into which the war and its WEB-INF/lib jars are unpacked. The fix was applied by the upstream Jetty vendor in 9.4.33.v20201020 (October 2020), and this version inherits it from upstream."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.63.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.63.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-10T04:17:33.879237+00:00",
      "status_notes": "Vulnerability CVE-2021-28164 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty:jetty-webapp. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because encoded dot segments are normalized before request handling, allowing protected directory checks to block access. jetty-http/src/main/java/org/eclipse/jetty/http/HttpURI.java:868 decodes and canonicalizes the path and rejects invalid results. jetty-server/src/main/java/org/eclipse/jetty/server/handler/ContextHandler.java:1433 returns 404 for protected targets before servlet dispatch.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-28164"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because encoded dot segments are normalized before request handling, allowing protected directory checks to block access. jetty-http/src/main/java/org/eclipse/jetty/http/HttpURI.java:868 decodes and canonicalizes the path and rejects invalid results. jetty-server/src/main/java/org/eclipse/jetty/server/handler/ContextHandler.java:1433 returns 404 for protected targets before servlet dispatch."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.63.tuxcare0001",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.63.tuxcare0001"
          }
        }
      ],
      "timestamp": "2026-11-03T03:42:38.974178+00:00",
      "status_notes": "Vulnerability CVE-2021-34429 does not affect version 9.4.63.tuxcare0001 of org.eclipse.jetty:jetty-webapp. not_affected \u2014 The target repository (version 9.4.63) is not affected by CVE-2021-34429. The vulnerability was fixed in upstream Jetty version 9.4.43 (June 2021) by commit f045b5a3bad, which was already included in the upstream release before TuxCare began maintaining this branch. The fix implements multiple defensive layers: (1) URIs are decoded before normalization to prevent encoded path traversal, (2) pat...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-34429"
      },
      "impact_statement": "not_affected \u2014 The target repository (version 9.4.63) is not affected by CVE-2021-34429. The vulnerability was fixed in upstream Jetty version 9.4.43 (June 2021) by commit f045b5a3bad, which was already included in the upstream release before TuxCare began maintaining this branch. The fix implements multiple defensive layers: (1) URIs are decoded before normalization to prevent encoded path traversal, (2) pat..."
    }
  ]
}