{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:74b75280-4c07-57b4-bce7-3b48d071c80c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "undertow-examples", "purl": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.2", "type": "library", "group": "io.undertow", "bom-ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.2", "version": "1.4.27.Final-tuxcare.2", "pedigree": { "ancestors": [ { "name": "undertow-examples", "purl": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final", "type": "library", "group": "io.undertow", "version": "1.4.27.Final" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-7816", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:abf261a5-3ac9-5fc7-8f5b-b73b1ef095fa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-7816 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-examples." } }, { "id": "CVE-2016-7046", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:3bd4b234-8fc4-560d-b943-519493d9d3dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-7046 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-examples." } }, { "id": "CVE-2017-12165", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:ca6614f8-d9fd-574a-9045-6f77104209f0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-12165 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-examples." } }, { "id": "CVE-2017-12196", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:ab228964-9e6c-5e43-9e6b-5b919e9ef085", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12196 does not affect version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-examples. not_affected \u2014 CVE-2017-12196 is an Undertow Digest-auth flaw: the server failed to verify that the \"digest-uri\" value inside the Authorization header matches the actual HTTP request-line URI, enabling a MITM/credential-reuse attack (a captured Digest credential could be redirected to a different resource). Fixed upstream in 1.4.24.Final (UNDERTOW-1190). The target is undertow 1.4.27.Final (tuxcare.1 backport), which is AFTER the fix version. Direct code inspection confirms the fix is present: DigestAuthenticationMechanism.handleDigestHeader() (core/.../security/impl/DigestAuthenticationMechanism.java:233-257) compares the Authorization \"digest-uri\" token against the reconstructed request URI (path + \"?\" + query) and, as an enhancement, against the absolute request URL; on mismatch it sets 400 BAD_REQUEST and ends the exchange without authenticating, and if the DIGEST_URI token is absent it returns NOT_AUTHENTICATED. The check is on the sole Digest execution path (authenticate() -> handleDigestHeader(), line 167) and precedes credential (H(A2)) validation, with no bypass. git blame attributes lines 233-239 to upstream commit c916239d and lines 240-254 to upstream commit 11b6f0e0, both by Stuart Douglas (stuart.w.douglas@gmail.com). Both commits are ancestors of the plain upstream 1.4.27.Final commit, so the fix shipped upstream before TuxCare onboarding. Verdict: not_affected (upstream fix already present; not a TuxCare backport, so not \"already_fixed\"). [VC re-run with claude-opus-4-8, prod prompt pin d46bd7a, 2026-09-16; Sonnet run failed the author gate (A2 onboarding-merge overclaim); applied manually after git verification]", "justification": "code_not_present" } }, { "id": "CVE-2017-2666", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:ddc81297-45ae-5219-8780-1a11044d5d56", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-2666 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-examples." } }, { "id": "CVE-2017-2670", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:37578d4b-0ea8-593c-8fdd-2b7c648ff22b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-2670 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-examples." } }, { "id": "CVE-2017-7559", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:eaea8bf3-7c36-59e6-9780-2662bb097a74", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7559 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-examples." } }, { "id": "CVE-2018-1114", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:da6e0f1d-9b1b-5abc-b760-80bfb72d3a99", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1114 does not affect version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-examples. not_affected \u2014 Target is Undertow 1.4.27.Final (undertow-io/undertow) \u2014 correct product, not a false positive. CVE-2018-1114 is the file-descriptor leak where URLResource.getLastModified()/getContentLength() opened a URLConnection but closed the underlying stream only at GC finalization, exhausting file descriptors (DoS). The complete upstream fix is already present in the shipped 1.4.27.Final source. URLResource.openConnection() (core/.../resource/URLResource.java:80-110) closes the connection's input stream promptly in a finally block (IoUtils.safeClose(connection.getInputStream()), lines 100-108) and, for jar: URLs, disables caching and reads the timestamp from the underlying jar file directly (setUseCaches(false) + File.lastModified(), lines 92-98) \u2014 exactly the change in the provided patch commits 882d5884/7f22aa0090. git blame attributes these lines to upstream commits 87f4fb41fc (UNDERTOW-1081, 2017-05-24) and 7f22aa0090 (UNDERTOW-1338, 2018-04-24), both ancestors of HEAD, both predating the 1.4.27.Final release. The vulnerable close-on-finalization pattern is therefore absent from HEAD. The fix is upstream-authored (stuart.w.douglas@gmail.com / norito.agetsuma@gmail.com), NOT a TuxCare/CloudLinux backport, and URLResource.java was not modified after onboarding \u2014 so verdict is not_affected (vendor fix already shipped), justification code_not_present. [VC re-run with claude-opus-4-8, prod prompt pin d46bd7a, 2026-09-16; Sonnet run failed the author gate (A2 onboarding-merge overclaim); applied manually after git verification]", "justification": "code_not_present" } }, { "id": "CVE-2018-14642", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:abbcc6c1-59ba-5cf6-95cb-f6f3194bb61f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-14642 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-examples." } }, { "id": "CVE-2019-10184", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:6c1c274a-af33-51e4-a3a3-b123d79e6321", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10184 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-examples." } }, { "id": "CVE-2019-10212", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:013c3455-ee93-5115-b750-514870758609", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10212 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-examples." } }, { "id": "CVE-2019-14888", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:3c479c36-2992-52fd-9fdc-e3acb3835876", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-14888 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-examples." } }, { "id": "CVE-2019-19343", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:921624f4-17f8-5d19-913b-d2270c47ae26", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-19343 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-examples." } }, { "id": "CVE-2019-3888", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:bb5f87bd-6ec8-5843-80ca-645f2799e79d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3888 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-examples." } }, { "id": "CVE-2020-10687", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:0f150352-970e-58ad-b9f7-08589e8192ef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10687 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-examples." } }, { "id": "CVE-2020-10705", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:38abb741-d646-56b5-8ee9-a12a39b42d25", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10705 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-examples." } }, { "id": "CVE-2020-10719", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:03643c6a-f627-50a1-aa1a-d719e4ec6ca7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10719 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-examples." } }, { "id": "CVE-2020-1745", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:282c6da9-1702-5533-a249-eb195067d557", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1745 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-examples." } }, { "id": "CVE-2020-1757", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:53403193-6440-5abe-b4b9-0bfb3c98f30e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1757 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-examples." } }, { "id": "CVE-2020-27782", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:cfe9854b-9551-5c42-b123-1f696c3fd912", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27782 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-examples." } }, { "id": "CVE-2021-20220", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:937b9a7a-e14f-5094-b168-65e371eec67e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-20220 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-examples." } }, { "id": "CVE-2021-3597", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:d851e6ca-cb98-5427-96c5-5e394df0d337", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3597 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-examples." } }, { "id": "CVE-2021-3629", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:421a748f-bb44-5355-a3f2-60f9654366b2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3629 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-examples." } }, { "id": "CVE-2021-3690", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:a9935974-fd80-5062-894c-b8b666e13190", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3690 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-examples." } }, { "id": "CVE-2021-3859", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:c07c9ad0-ef0d-5a05-9964-e88d155fa792", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3859 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-examples." } }, { "id": "CVE-2022-1259", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:5cc3463d-325e-57f6-b20c-9aaccaa02e3c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-1259 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-examples." } }, { "id": "CVE-2022-1319", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:4664077b-4478-561d-ab58-918dee49b22e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-1319 does not affect version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-examples. Version 1.4.27.Final is not affected by CVE-2022-1319. The vulnerability was introduced in UNDERTOW-1824 (Oct 2020) when the handleBadRequest() method and related AJP response constants were added to versions 2.2.x and later. Version 1.4.27.Final (Jan 2019) predates this change and uses a simpler response mechanism that only calls httpServerExchange.endExchange() once without manual AJP packet generation, making the double-response vulnerability pattern impossible.", "justification": "code_not_present" } }, { "id": "CVE-2022-2053", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:56127dc5-66d0-5497-ad23-7b436c7f22aa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2053 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-examples." } }, { "id": "CVE-2022-4492", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:8d22a322-5180-5547-bdf7-ee35e5d322fa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-4492 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-examples." } }, { "id": "CVE-2023-1108", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:2387233f-1951-58c2-8205-a25b1971c2e8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-1108 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-examples." } }, { "id": "CVE-2023-1973", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:40ba18f7-2bc5-51b5-97f6-0377d0249771", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-1973 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-examples." } }, { "id": "CVE-2023-4639", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:4539ddf5-7370-5089-97b0-6d462c94dca1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-4639 is fixed in version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-examples." } }, { "id": "CVE-2024-1459", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:d1f3820e-6130-5c03-9b64-2b35172b10c0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-1459 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-examples." } }, { "id": "CVE-2024-1635", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:2b767275-1f34-5e92-b0b0-3a64d7cba2e1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-1635 is fixed in version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-examples." } }, { "id": "CVE-2024-3653", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:908bb773-a471-5029-8722-a46017ac5afd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-3653 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-examples." } }, { "id": "CVE-2024-3884", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:fd74d7d9-d979-5494-b140-adcae6b3e909", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-3884 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-examples." } }, { "id": "CVE-2024-4027", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:e4ee5a0c-314d-5e40-9332-1f524010cf05", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-4027 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-examples." } }, { "id": "CVE-2024-4109", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:dfe86e8b-026a-5167-a3de-18a50f12b4e5", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-4109 is a false positive for io.undertow:undertow-examples 1.4.27.Final-tuxcare.2." } }, { "id": "CVE-2024-5971", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:484dd31e-0832-596f-adb7-b31cc735084e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-5971 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-examples." } }, { "id": "CVE-2024-6162", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:099d3ecf-0bef-5b69-8a9a-7e1a5590dec4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6162 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-examples." } }, { "id": "CVE-2024-7885", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:36a3c777-269f-5c08-b3d9-0777c06c6f82", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7885 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-examples." } }, { "id": "CVE-2025-12543", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:126b5c85-42ad-596e-be87-6c5645d491ec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-12543 is fixed in version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-examples." } }, { "id": "CVE-2025-9784", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:a7a4845d-79c9-5a27-aae8-32cab1d39fd5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-9784 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-examples." } }, { "id": "CVE-2026-3260", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.2" } ], "bom-ref": "urn:uuid:809df39a-9d6f-532b-8322-fc608eebb792", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-3260 affects version 1.4.27.Final-tuxcare.2 of io.undertow:undertow-examples." } } ], "dependencies": [ { "ref": "pkg:maven/io.undertow/undertow-examples@1.4.27.Final-tuxcare.2" } ] }