{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:b111799b-4644-5149-a7ef-82e142398eb1", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "jetty-ee10-demo-proxy-webapp", "purl": "pkg:maven/org.eclipse.jetty.ee10.demos/jetty-ee10-demo-proxy-webapp@12.0.22-tuxcare.1", "type": "library", "group": "org.eclipse.jetty.ee10.demos", "bom-ref": "pkg:maven/org.eclipse.jetty.ee10.demos/jetty-ee10-demo-proxy-webapp@12.0.22-tuxcare.1", "version": "12.0.22-tuxcare.1", "pedigree": { "ancestors": [ { "name": "jetty-ee10-demo-proxy-webapp", "purl": "pkg:maven/org.eclipse.jetty.ee10.demos/jetty-ee10-demo-proxy-webapp@12.0.22", "type": "library", "group": "org.eclipse.jetty.ee10.demos", "version": "12.0.22" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2006-6969", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.demos/jetty-ee10-demo-proxy-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:b8cd458d-b1e6-5997-a6ed-f02d2f24721b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2006-6969 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.demos:jetty-ee10-demo-proxy-webapp." } }, { "id": "CVE-2007-1651", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.demos/jetty-ee10-demo-proxy-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:b7577bd4-0f6a-595c-af6f-14afe277536c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2007-1651 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.demos:jetty-ee10-demo-proxy-webapp. Target Jetty 12.0.22 is NOT affected. The CVE concerns a CSRF / session-restoration weakness in Jetty's OpenID Connect support; the two vendor patches (5f2c96dc, 2020 \u2014 move ID-token expiry to initial-auth-only + proper logout/validate delegation; e9f260f4, 2021 \u2014 replace the single anti-forgery CSRF token with a per-session, SecureRandom-keyed csrfMap and mandatory `state` validation) are UPSTREAM Jetty fixes authored by lachlan@webtide.com years before the 12.0.22 release (June 2025). Both fix commits are ancestors of HEAD, and the shipped jetty-core/jetty-openid and jetty-ee9/jetty-ee9-openid modules contain the complete post-fix code. The pre-fix vulnerable pattern (single CSRF_TOKEN setAttribute, isExpired() gating session validity, empty logout()) is absent. Not a TuxCare backport \u2014 the fix is native/upstream, so verdict is not_affected (justification code_not_present), not already_fixed.", "justification": "code_not_present" } }, { "id": "CVE-2007-1652", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.demos/jetty-ee10-demo-proxy-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:d5c18ddb-764b-5708-8f70-36a3764cabe6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2007-1652 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.demos:jetty-ee10-demo-proxy-webapp." } }, { "id": "CVE-2011-4461", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.demos/jetty-ee10-demo-proxy-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:5c384880-dfc1-5955-b007-6d4e8f74dcd6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-4461 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.demos:jetty-ee10-demo-proxy-webapp." } }, { "id": "CVE-2015-2080", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.demos/jetty-ee10-demo-proxy-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:1906dedd-50bd-5a10-9c2d-6a1366b53958", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-2080 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.demos:jetty-ee10-demo-proxy-webapp." } }, { "id": "CVE-2016-4800", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.demos/jetty-ee10-demo-proxy-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:0e0aa095-27dc-51a5-ad28-65bb84b360eb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-4800 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.demos:jetty-ee10-demo-proxy-webapp." } }, { "id": "CVE-2017-7656", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.demos/jetty-ee10-demo-proxy-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:6a41d2fd-3407-5554-bce8-8ca7e642f472", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7656 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.demos:jetty-ee10-demo-proxy-webapp." } }, { "id": "CVE-2017-7657", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.demos/jetty-ee10-demo-proxy-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:384f691f-8028-5f5c-9d91-0fc88661caa1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7657 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.demos:jetty-ee10-demo-proxy-webapp." } }, { "id": "CVE-2017-7658", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.demos/jetty-ee10-demo-proxy-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:86e953dd-b851-5abd-9c5f-a340f113b6c1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7658 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.demos:jetty-ee10-demo-proxy-webapp." } }, { "id": "CVE-2017-9735", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.demos/jetty-ee10-demo-proxy-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:f074b7d8-0ac5-56bb-a655-21d37aad56e9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-9735 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.demos:jetty-ee10-demo-proxy-webapp." } }, { "id": "CVE-2018-12536", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.demos/jetty-ee10-demo-proxy-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:3ef6b24c-e448-5d9f-a606-fc0a4070eaad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12536 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.demos:jetty-ee10-demo-proxy-webapp." } }, { "id": "CVE-2018-12538", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.demos/jetty-ee10-demo-proxy-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:4bf95f74-8633-57a1-8c88-cd43d634af34", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12538 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.demos:jetty-ee10-demo-proxy-webapp." } }, { "id": "CVE-2018-12545", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.demos/jetty-ee10-demo-proxy-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:271eb98c-6e74-50e4-a5f9-5925ddfe3877", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12545 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.demos:jetty-ee10-demo-proxy-webapp." } }, { "id": "CVE-2019-10241", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.demos/jetty-ee10-demo-proxy-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:901be7fb-cc34-59da-b9fe-c24ccba652a9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10241 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.demos:jetty-ee10-demo-proxy-webapp." } }, { "id": "CVE-2019-10246", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.demos/jetty-ee10-demo-proxy-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:690a5727-5eab-5662-8e65-870d00d9eaf4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10246 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.demos:jetty-ee10-demo-proxy-webapp." } }, { "id": "CVE-2019-10247", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.demos/jetty-ee10-demo-proxy-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:2bd3effa-4642-51c1-8ea7-6988880042e2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10247 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.demos:jetty-ee10-demo-proxy-webapp." } }, { "id": "CVE-2019-17632", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.demos/jetty-ee10-demo-proxy-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:dd79001f-1c76-5ac4-8bd7-568b5213be5f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17632 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.demos:jetty-ee10-demo-proxy-webapp." } }, { "id": "CVE-2019-17638", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.demos/jetty-ee10-demo-proxy-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:ee8ce9da-5904-5d8f-9386-e7c4352ed470", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17638 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.demos:jetty-ee10-demo-proxy-webapp." } }, { "id": "CVE-2020-27218", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.demos/jetty-ee10-demo-proxy-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:d3d3578b-66e4-595f-bf93-710b8f1d97a1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27218 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.demos:jetty-ee10-demo-proxy-webapp." } }, { "id": "CVE-2020-27223", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.demos/jetty-ee10-demo-proxy-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:5f2785df-0761-5ce7-ae5d-4b034235ed68", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27223 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.demos:jetty-ee10-demo-proxy-webapp." } }, { "id": "CVE-2021-28165", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.demos/jetty-ee10-demo-proxy-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:fe719eb4-6e27-5663-bbe7-26622d2474f5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28165 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.demos:jetty-ee10-demo-proxy-webapp." } }, { "id": "CVE-2021-34428", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.demos/jetty-ee10-demo-proxy-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:65bfb2ac-70c7-5ccf-8f80-0f271b0b9c9d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.demos:jetty-ee10-demo-proxy-webapp." } }, { "id": "CVE-2022-2047", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.demos/jetty-ee10-demo-proxy-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:c09a682c-3c05-51ce-91e1-1de97cbe9e25", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2047 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.demos:jetty-ee10-demo-proxy-webapp." } }, { "id": "CVE-2022-2191", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.demos/jetty-ee10-demo-proxy-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:5046dd6b-2d2e-5e0d-a653-826208c6b95f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2191 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.demos:jetty-ee10-demo-proxy-webapp." } }, { "id": "CVE-2023-26048", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.demos/jetty-ee10-demo-proxy-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:288ac215-20e0-511d-9ff6-f350b3d627f4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26048 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.demos:jetty-ee10-demo-proxy-webapp." } }, { "id": "CVE-2023-26049", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.demos/jetty-ee10-demo-proxy-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:b19e7e88-76a3-581f-8074-d53f7e50393b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26049 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.demos:jetty-ee10-demo-proxy-webapp." } }, { "id": "CVE-2023-40167", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.demos/jetty-ee10-demo-proxy-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:2c5913de-3ec4-5925-82fd-0721cf03f8b8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-40167 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.demos:jetty-ee10-demo-proxy-webapp." } }, { "id": "CVE-2024-13009", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.demos/jetty-ee10-demo-proxy-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:e718ee2e-17f4-52b0-823c-f6ebb91d2640", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-13009 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.demos:jetty-ee10-demo-proxy-webapp." } }, { "id": "CVE-2024-6763", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.demos/jetty-ee10-demo-proxy-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:baf2a91a-be47-5dc1-8c67-1048c7c6d99b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.demos:jetty-ee10-demo-proxy-webapp." } }, { "id": "CVE-2024-7708", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.demos/jetty-ee10-demo-proxy-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:3803771a-65f5-5587-9874-72da5d72c184", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7708 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.demos:jetty-ee10-demo-proxy-webapp." } }, { "id": "CVE-2024-8184", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.demos/jetty-ee10-demo-proxy-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:c2cd1642-05b4-52f1-8223-7f83cbeb5d40", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.demos:jetty-ee10-demo-proxy-webapp." } }, { "id": "CVE-2025-11143", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.demos/jetty-ee10-demo-proxy-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:5084fe4f-8101-51d1-8cdc-d7799c8c7504", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.demos:jetty-ee10-demo-proxy-webapp." } }, { "id": "CVE-2026-10051", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.demos/jetty-ee10-demo-proxy-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:05d61ece-0ff7-588f-9b0b-867966f45124", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10051 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.demos:jetty-ee10-demo-proxy-webapp." } }, { "id": "CVE-2026-1605", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.demos/jetty-ee10-demo-proxy-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:b3ce21e4-1c61-5708-bbe1-96fd5de076e7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1605 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.demos:jetty-ee10-demo-proxy-webapp." } }, { "id": "CVE-2026-18660", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.demos/jetty-ee10-demo-proxy-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:b2e50969-4d18-5a81-8184-f61ef85fac8b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18660 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.demos:jetty-ee10-demo-proxy-webapp." } }, { "id": "CVE-2026-2332", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.demos/jetty-ee10-demo-proxy-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:1eb727cb-8bb3-5296-a729-48a122733b5c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-2332 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.demos:jetty-ee10-demo-proxy-webapp." } }, { "id": "CVE-2026-6790", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.demos/jetty-ee10-demo-proxy-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:0492b2af-6ac4-5fc6-aa2d-84857978bb0f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6790 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.demos:jetty-ee10-demo-proxy-webapp." } }, { "id": "CVE-2026-8384", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.demos/jetty-ee10-demo-proxy-webapp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:dd7071ba-9f0c-59c3-9919-6e5bb509fda7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-8384 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.demos:jetty-ee10-demo-proxy-webapp." } } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.demos/jetty-ee10-demo-proxy-webapp@12.0.22-tuxcare.1" } ] }