{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:237b1d4e-9c8f-5193-9b45-e12d9a0895aa", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "karaf", "purl": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.2", "type": "library", "group": "io.undertow", "bom-ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.2", "version": "1.4.27.Final-tuxcare.2", "pedigree": { "ancestors": [ { "name": "karaf", "purl": "pkg:maven/io.undertow/karaf@1.4.27.Final", "type": "library", "group": "io.undertow", "version": "1.4.27.Final" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-7816", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:e30553fa-41f4-5a5f-b205-2522528e6b02", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-7816 affects version 1.4.27.Final-tuxcare.2 of io.undertow:karaf." } }, { "id": "CVE-2016-7046", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:7374e705-db08-5eab-913a-2d8fff879f00", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-7046 affects version 1.4.27.Final-tuxcare.2 of io.undertow:karaf." } }, { "id": "CVE-2017-12165", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:2d06f5d4-6df8-511c-a5a4-4bfaf8986a89", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-12165 affects version 1.4.27.Final-tuxcare.2 of io.undertow:karaf." } }, { "id": "CVE-2017-12196", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:535d2b99-fa84-5832-bdf9-e3be23773a1c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12196 does not affect version 1.4.27.Final-tuxcare.2 of io.undertow:karaf. not_affected \u2014 CVE-2017-12196 is an Undertow Digest-auth flaw: the server failed to verify that the \"digest-uri\" value inside the Authorization header matches the actual HTTP request-line URI, enabling a MITM/credential-reuse attack (a captured Digest credential could be redirected to a different resource). Fixed upstream in 1.4.24.Final (UNDERTOW-1190). The target is undertow 1.4.27.Final (tuxcare.1 backport), which is AFTER the fix version. Direct code inspection confirms the fix is present: DigestAuthenticationMechanism.handleDigestHeader() (core/.../security/impl/DigestAuthenticationMechanism.java:233-257) compares the Authorization \"digest-uri\" token against the reconstructed request URI (path + \"?\" + query) and, as an enhancement, against the absolute request URL; on mismatch it sets 400 BAD_REQUEST and ends the exchange without authenticating, and if the DIGEST_URI token is absent it returns NOT_AUTHENTICATED. The check is on the sole Digest execution path (authenticate() -> handleDigestHeader(), line 167) and precedes credential (H(A2)) validation, with no bypass. git blame attributes lines 233-239 to upstream commit c916239d and lines 240-254 to upstream commit 11b6f0e0, both by Stuart Douglas (stuart.w.douglas@gmail.com). Both commits are ancestors of the plain upstream 1.4.27.Final commit, so the fix shipped upstream before TuxCare onboarding. Verdict: not_affected (upstream fix already present; not a TuxCare backport, so not \"already_fixed\"). [VC re-run with claude-opus-4-8, prod prompt pin d46bd7a, 2026-09-16; Sonnet run failed the author gate (A2 onboarding-merge overclaim); applied manually after git verification]", "justification": "code_not_present" } }, { "id": "CVE-2017-2666", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:0aea27d7-b439-5e67-b724-90d0fdf39aad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-2666 affects version 1.4.27.Final-tuxcare.2 of io.undertow:karaf." } }, { "id": "CVE-2017-2670", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:f0669518-e9c9-517a-b079-b9dc64527a14", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-2670 affects version 1.4.27.Final-tuxcare.2 of io.undertow:karaf." } }, { "id": "CVE-2017-7559", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:d40e0b04-ccf3-5121-b4a9-2218c95071ba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7559 affects version 1.4.27.Final-tuxcare.2 of io.undertow:karaf." } }, { "id": "CVE-2018-1114", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:29ace5ad-4ce3-5c2f-98d2-8ae83278c3d6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1114 does not affect version 1.4.27.Final-tuxcare.2 of io.undertow:karaf. not_affected \u2014 Target is Undertow 1.4.27.Final (undertow-io/undertow) \u2014 correct product, not a false positive. CVE-2018-1114 is the file-descriptor leak where URLResource.getLastModified()/getContentLength() opened a URLConnection but closed the underlying stream only at GC finalization, exhausting file descriptors (DoS). The complete upstream fix is already present in the shipped 1.4.27.Final source. URLResource.openConnection() (core/.../resource/URLResource.java:80-110) closes the connection's input stream promptly in a finally block (IoUtils.safeClose(connection.getInputStream()), lines 100-108) and, for jar: URLs, disables caching and reads the timestamp from the underlying jar file directly (setUseCaches(false) + File.lastModified(), lines 92-98) \u2014 exactly the change in the provided patch commits 882d5884/7f22aa0090. git blame attributes these lines to upstream commits 87f4fb41fc (UNDERTOW-1081, 2017-05-24) and 7f22aa0090 (UNDERTOW-1338, 2018-04-24), both ancestors of HEAD, both predating the 1.4.27.Final release. The vulnerable close-on-finalization pattern is therefore absent from HEAD. The fix is upstream-authored (stuart.w.douglas@gmail.com / norito.agetsuma@gmail.com), NOT a TuxCare/CloudLinux backport, and URLResource.java was not modified after onboarding \u2014 so verdict is not_affected (vendor fix already shipped), justification code_not_present. [VC re-run with claude-opus-4-8, prod prompt pin d46bd7a, 2026-09-16; Sonnet run failed the author gate (A2 onboarding-merge overclaim); applied manually after git verification]", "justification": "code_not_present" } }, { "id": "CVE-2018-14642", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:c03fda23-e257-52ae-97cc-eb24ddcc338b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-14642 affects version 1.4.27.Final-tuxcare.2 of io.undertow:karaf." } }, { "id": "CVE-2019-10184", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:bf5127ab-0367-5798-95e4-5bd0b18b7bd2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10184 affects version 1.4.27.Final-tuxcare.2 of io.undertow:karaf." } }, { "id": "CVE-2019-10212", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:3b9d53df-a097-5863-9a71-696f72b274af", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10212 affects version 1.4.27.Final-tuxcare.2 of io.undertow:karaf." } }, { "id": "CVE-2019-14888", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:20775b89-83e7-5965-b1b1-6c37a9373762", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-14888 affects version 1.4.27.Final-tuxcare.2 of io.undertow:karaf." } }, { "id": "CVE-2019-19343", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:1537d022-29e4-5718-99ac-91731042e1eb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-19343 affects version 1.4.27.Final-tuxcare.2 of io.undertow:karaf." } }, { "id": "CVE-2019-3888", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:192584b6-121e-5a5d-b383-c336236ea11d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3888 affects version 1.4.27.Final-tuxcare.2 of io.undertow:karaf." } }, { "id": "CVE-2020-10687", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:e035ae42-c7af-5cb0-9909-5648e66412f0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10687 affects version 1.4.27.Final-tuxcare.2 of io.undertow:karaf." } }, { "id": "CVE-2020-10705", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:891c9167-2715-5a36-8859-b0fed294c0f7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10705 affects version 1.4.27.Final-tuxcare.2 of io.undertow:karaf." } }, { "id": "CVE-2020-10719", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:37a1b9b0-0a3d-5dea-b58b-1a359563fa8a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10719 affects version 1.4.27.Final-tuxcare.2 of io.undertow:karaf." } }, { "id": "CVE-2020-1745", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:ecf87f8a-daf7-5100-a61c-6fd3a8d6ba35", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1745 affects version 1.4.27.Final-tuxcare.2 of io.undertow:karaf." } }, { "id": "CVE-2020-1757", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:bf6786d5-f5bd-5ca2-b735-d597e49eebd6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1757 affects version 1.4.27.Final-tuxcare.2 of io.undertow:karaf." } }, { "id": "CVE-2020-27782", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:65af080e-fa77-59be-abbc-305c362fe9f5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27782 affects version 1.4.27.Final-tuxcare.2 of io.undertow:karaf." } }, { "id": "CVE-2021-20220", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:d18ed209-4ad8-5063-aba7-2a25414c0fc6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-20220 affects version 1.4.27.Final-tuxcare.2 of io.undertow:karaf." } }, { "id": "CVE-2021-3597", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:2f16504c-d592-5060-8a9b-8d85872a9465", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3597 affects version 1.4.27.Final-tuxcare.2 of io.undertow:karaf." } }, { "id": "CVE-2021-3629", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:8ddfbd23-d148-5bd3-aec9-21d6c29dab02", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3629 affects version 1.4.27.Final-tuxcare.2 of io.undertow:karaf." } }, { "id": "CVE-2021-3690", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:6b4bc09b-e5ad-5a2e-aaf8-bf06619df1bc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3690 affects version 1.4.27.Final-tuxcare.2 of io.undertow:karaf." } }, { "id": "CVE-2021-3859", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:dc29edc5-8320-5ba4-8e0d-70a1c9687fa9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3859 affects version 1.4.27.Final-tuxcare.2 of io.undertow:karaf." } }, { "id": "CVE-2022-1259", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:772ebeed-9ea4-5516-b939-1f33aa712d7a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-1259 affects version 1.4.27.Final-tuxcare.2 of io.undertow:karaf." } }, { "id": "CVE-2022-1319", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:3d746053-d1ea-5111-a966-30729c80faf7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-1319 does not affect version 1.4.27.Final-tuxcare.2 of io.undertow:karaf. Version 1.4.27.Final is not affected by CVE-2022-1319. The vulnerability was introduced in UNDERTOW-1824 (Oct 2020) when the handleBadRequest() method and related AJP response constants were added to versions 2.2.x and later. Version 1.4.27.Final (Jan 2019) predates this change and uses a simpler response mechanism that only calls httpServerExchange.endExchange() once without manual AJP packet generation, making the double-response vulnerability pattern impossible.", "justification": "code_not_present" } }, { "id": "CVE-2022-2053", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:ab398492-f789-5c8a-a4a7-408abc77b67f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2053 affects version 1.4.27.Final-tuxcare.2 of io.undertow:karaf." } }, { "id": "CVE-2022-4492", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:3d60c022-a93f-5211-94a3-d1bcf8ddab8b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-4492 affects version 1.4.27.Final-tuxcare.2 of io.undertow:karaf." } }, { "id": "CVE-2023-1108", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:40f54008-696a-5de8-8cd6-67bbffd3fd70", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-1108 affects version 1.4.27.Final-tuxcare.2 of io.undertow:karaf." } }, { "id": "CVE-2023-1973", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:6ed84fc6-6887-5e2f-ae37-fb0d774384d5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-1973 affects version 1.4.27.Final-tuxcare.2 of io.undertow:karaf." } }, { "id": "CVE-2023-4639", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:ab253e1d-0a05-5546-912a-02e81f61ddad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-4639 is fixed in version 1.4.27.Final-tuxcare.2 of io.undertow:karaf." } }, { "id": "CVE-2024-1459", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:9d9a72df-28fa-535f-96fe-3eba9917d4a2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-1459 affects version 1.4.27.Final-tuxcare.2 of io.undertow:karaf." } }, { "id": "CVE-2024-1635", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:181a47ea-4b0e-521f-af52-d714419c50a3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-1635 is fixed in version 1.4.27.Final-tuxcare.2 of io.undertow:karaf." } }, { "id": "CVE-2024-3653", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:dfe68d66-5a8e-5be1-8837-67c8e9168576", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-3653 affects version 1.4.27.Final-tuxcare.2 of io.undertow:karaf." } }, { "id": "CVE-2024-3884", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:ed5a73e5-7a6e-5d7d-b883-bf77a4e07a43", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-3884 affects version 1.4.27.Final-tuxcare.2 of io.undertow:karaf." } }, { "id": "CVE-2024-4027", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:fc58a664-bc93-5923-91aa-b19fb940b7d6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-4027 affects version 1.4.27.Final-tuxcare.2 of io.undertow:karaf." } }, { "id": "CVE-2024-4109", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:9becc186-f91f-5e93-8d7f-6fffc57318c4", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-4109 is a false positive for io.undertow:karaf 1.4.27.Final-tuxcare.2." } }, { "id": "CVE-2024-5971", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:43d6654f-544c-5222-a9ed-9689c00f8fef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-5971 affects version 1.4.27.Final-tuxcare.2 of io.undertow:karaf." } }, { "id": "CVE-2024-6162", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:c081ca97-b337-5f10-ad95-93b26bacad15", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6162 affects version 1.4.27.Final-tuxcare.2 of io.undertow:karaf." } }, { "id": "CVE-2024-7885", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:b219bd2d-e3ce-56fc-bb41-722377c31f98", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7885 affects version 1.4.27.Final-tuxcare.2 of io.undertow:karaf." } }, { "id": "CVE-2025-12543", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:bc17db28-669c-58d6-baf7-ef58cce2cc80", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-12543 is fixed in version 1.4.27.Final-tuxcare.2 of io.undertow:karaf." } }, { "id": "CVE-2025-9784", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:cd6a9b46-170a-50af-a182-9d0b7daf7ed6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-9784 affects version 1.4.27.Final-tuxcare.2 of io.undertow:karaf." } }, { "id": "CVE-2026-3260", "affects": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:7c414a5e-7627-50b2-8fe2-1d663db49740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-3260 affects version 1.4.27.Final-tuxcare.2 of io.undertow:karaf." } } ], "dependencies": [ { "ref": "pkg:maven/io.undertow/karaf@1.4.27.Final-tuxcare.2" } ] }