{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e59dc1f8-99c5-532a-b200-13b2ef307ee0", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "jetty-ee10-osgi-boot-jsp", "purl": "pkg:maven/org.eclipse.jetty.ee10.osgi/jetty-ee10-osgi-boot-jsp@12.0.22-tuxcare.1", "type": "library", "group": "org.eclipse.jetty.ee10.osgi", "bom-ref": "pkg:maven/org.eclipse.jetty.ee10.osgi/jetty-ee10-osgi-boot-jsp@12.0.22-tuxcare.1", "version": "12.0.22-tuxcare.1", "pedigree": { "ancestors": [ { "name": "jetty-ee10-osgi-boot-jsp", "purl": "pkg:maven/org.eclipse.jetty.ee10.osgi/jetty-ee10-osgi-boot-jsp@12.0.22", "type": "library", "group": "org.eclipse.jetty.ee10.osgi", "version": "12.0.22" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2006-6969", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.osgi/jetty-ee10-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:600bb071-1e14-502e-81ac-158c118a4914", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2006-6969 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.osgi:jetty-ee10-osgi-boot-jsp." } }, { "id": "CVE-2007-1651", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.osgi/jetty-ee10-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:0625b7a9-a15d-5d5e-9953-ced6465c0f64", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2007-1651 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.osgi:jetty-ee10-osgi-boot-jsp. Target Jetty 12.0.22 is NOT affected. The CVE concerns a CSRF / session-restoration weakness in Jetty's OpenID Connect support; the two vendor patches (5f2c96dc, 2020 \u2014 move ID-token expiry to initial-auth-only + proper logout/validate delegation; e9f260f4, 2021 \u2014 replace the single anti-forgery CSRF token with a per-session, SecureRandom-keyed csrfMap and mandatory `state` validation) are UPSTREAM Jetty fixes authored by lachlan@webtide.com years before the 12.0.22 release (June 2025). Both fix commits are ancestors of HEAD, and the shipped jetty-core/jetty-openid and jetty-ee9/jetty-ee9-openid modules contain the complete post-fix code. The pre-fix vulnerable pattern (single CSRF_TOKEN setAttribute, isExpired() gating session validity, empty logout()) is absent. Not a TuxCare backport \u2014 the fix is native/upstream, so verdict is not_affected (justification code_not_present), not already_fixed.", "justification": "code_not_present" } }, { "id": "CVE-2007-1652", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.osgi/jetty-ee10-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:4faa7938-6051-5751-868e-c9a0a49de0cc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2007-1652 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.osgi:jetty-ee10-osgi-boot-jsp." } }, { "id": "CVE-2011-4461", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.osgi/jetty-ee10-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:7c580b6b-f4f3-55d6-a104-81d7c4eed4e4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-4461 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.osgi:jetty-ee10-osgi-boot-jsp." } }, { "id": "CVE-2015-2080", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.osgi/jetty-ee10-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:140ae89b-356c-51bb-85fb-085da08c4c20", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-2080 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.osgi:jetty-ee10-osgi-boot-jsp." } }, { "id": "CVE-2016-4800", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.osgi/jetty-ee10-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:dd58631a-57eb-54a7-9f9d-35b448593077", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-4800 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.osgi:jetty-ee10-osgi-boot-jsp." } }, { "id": "CVE-2017-7656", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.osgi/jetty-ee10-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:787617aa-7ba8-5aff-a5bc-6d7ca9a8cab8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7656 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.osgi:jetty-ee10-osgi-boot-jsp." } }, { "id": "CVE-2017-7657", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.osgi/jetty-ee10-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:75e26e00-d52a-5fe1-bd5a-47703ce9ccdc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7657 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.osgi:jetty-ee10-osgi-boot-jsp." } }, { "id": "CVE-2017-7658", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.osgi/jetty-ee10-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:28013bb2-5191-53b6-a355-203ad284751a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7658 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.osgi:jetty-ee10-osgi-boot-jsp." } }, { "id": "CVE-2017-9735", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.osgi/jetty-ee10-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:400b4888-cee8-57d7-8d11-471726198347", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-9735 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.osgi:jetty-ee10-osgi-boot-jsp." } }, { "id": "CVE-2018-12536", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.osgi/jetty-ee10-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:2b3fbea5-eab7-517f-b7fa-d47ba92ba710", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12536 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.osgi:jetty-ee10-osgi-boot-jsp." } }, { "id": "CVE-2018-12538", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.osgi/jetty-ee10-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:608eda93-edc2-5bf3-afb6-48a17dc6b27a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12538 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.osgi:jetty-ee10-osgi-boot-jsp." } }, { "id": "CVE-2018-12545", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.osgi/jetty-ee10-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:0749c51e-9500-592e-8621-797649a4d883", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12545 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.osgi:jetty-ee10-osgi-boot-jsp." } }, { "id": "CVE-2019-10241", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.osgi/jetty-ee10-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:92803ec0-a577-5c1a-91c1-b30ec2c101ef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10241 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.osgi:jetty-ee10-osgi-boot-jsp." } }, { "id": "CVE-2019-10246", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.osgi/jetty-ee10-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:638f23f1-822d-56ba-8eb0-e103f5f9fc00", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10246 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.osgi:jetty-ee10-osgi-boot-jsp." } }, { "id": "CVE-2019-10247", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.osgi/jetty-ee10-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:6acdffb4-a0fc-5ba0-8439-6b2afedfe775", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10247 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.osgi:jetty-ee10-osgi-boot-jsp." } }, { "id": "CVE-2019-17632", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.osgi/jetty-ee10-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:3fa5f997-7d5c-50ee-bb8f-714802cae867", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17632 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.osgi:jetty-ee10-osgi-boot-jsp." } }, { "id": "CVE-2019-17638", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.osgi/jetty-ee10-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:1f3e83f2-df40-548c-8660-2d804f062bfe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17638 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.osgi:jetty-ee10-osgi-boot-jsp." } }, { "id": "CVE-2020-27218", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.osgi/jetty-ee10-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:dacc285a-55b7-5629-92ad-3d28eb93cfa6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27218 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.osgi:jetty-ee10-osgi-boot-jsp." } }, { "id": "CVE-2020-27223", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.osgi/jetty-ee10-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:6c6849dc-bee8-5306-a569-b4880f04eddb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27223 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.osgi:jetty-ee10-osgi-boot-jsp." } }, { "id": "CVE-2021-28163", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.osgi/jetty-ee10-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:096f2315-a95e-5c40-96dd-e0b7ad72a0bc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28163 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.osgi:jetty-ee10-osgi-boot-jsp." } }, { "id": "CVE-2021-28165", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.osgi/jetty-ee10-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:82e82906-dc9c-5f1e-89e8-24604681747d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28165 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.osgi:jetty-ee10-osgi-boot-jsp." } }, { "id": "CVE-2021-34428", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.osgi/jetty-ee10-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:b1516090-9421-5487-a7bc-0ff91efff4e9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.osgi:jetty-ee10-osgi-boot-jsp." } }, { "id": "CVE-2022-2047", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.osgi/jetty-ee10-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:cf7bfe0e-604b-503b-bd32-2b8c3c60331f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2047 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.osgi:jetty-ee10-osgi-boot-jsp." } }, { "id": "CVE-2022-2191", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.osgi/jetty-ee10-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:58456133-32b5-504d-8f04-79559d0664c1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2191 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.osgi:jetty-ee10-osgi-boot-jsp." } }, { "id": "CVE-2023-26048", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.osgi/jetty-ee10-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:b16f32e0-de9a-5fbc-9489-a029386580e6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26048 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.osgi:jetty-ee10-osgi-boot-jsp." } }, { "id": "CVE-2023-26049", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.osgi/jetty-ee10-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:157ff599-55c4-5b7d-9fce-801fc39e282c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26049 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.osgi:jetty-ee10-osgi-boot-jsp." } }, { "id": "CVE-2023-40167", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.osgi/jetty-ee10-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:dbc8bc47-f9ed-511d-bd83-bc39a2578ba3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-40167 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.osgi:jetty-ee10-osgi-boot-jsp." } }, { "id": "CVE-2024-13009", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.osgi/jetty-ee10-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:2d3907f1-b878-57a9-8620-7394cbac14da", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-13009 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.osgi:jetty-ee10-osgi-boot-jsp." } }, { "id": "CVE-2024-6763", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.osgi/jetty-ee10-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:a7b96b64-bc54-59f6-a3d9-fa1d718887bc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.osgi:jetty-ee10-osgi-boot-jsp." } }, { "id": "CVE-2024-7708", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.osgi/jetty-ee10-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:84d2e313-c980-5891-bef4-2313b935c398", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7708 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.osgi:jetty-ee10-osgi-boot-jsp." } }, { "id": "CVE-2024-8184", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.osgi/jetty-ee10-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:3958cc3c-a674-5ec0-81cc-734df773eb0a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.osgi:jetty-ee10-osgi-boot-jsp." } }, { "id": "CVE-2025-11143", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.osgi/jetty-ee10-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:e9e113f4-62fd-5400-aa63-c43efe72703a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.osgi:jetty-ee10-osgi-boot-jsp." } }, { "id": "CVE-2026-10051", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.osgi/jetty-ee10-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:037cf7eb-695c-5257-9474-1ec31859436c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10051 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.osgi:jetty-ee10-osgi-boot-jsp." } }, { "id": "CVE-2026-1605", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.osgi/jetty-ee10-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:35162722-8b37-5e0a-8ffc-d38e3ebef325", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1605 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.osgi:jetty-ee10-osgi-boot-jsp." } }, { "id": "CVE-2026-18660", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.osgi/jetty-ee10-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:e638d5e8-001d-508a-812c-a16fb40a63b7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18660 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.osgi:jetty-ee10-osgi-boot-jsp." } }, { "id": "CVE-2026-2332", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.osgi/jetty-ee10-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:1ccb279b-0a3c-5610-9b37-d0af28274e54", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-2332 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.osgi:jetty-ee10-osgi-boot-jsp." } }, { "id": "CVE-2026-6790", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.osgi/jetty-ee10-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:894dcba2-b8a8-5e69-b90e-084009cf877b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6790 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.osgi:jetty-ee10-osgi-boot-jsp." } }, { "id": "CVE-2026-8384", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.osgi/jetty-ee10-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:04746c22-8a0b-55c6-a4ec-f56ff4dcb881", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-8384 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.osgi:jetty-ee10-osgi-boot-jsp." } }, { "id": "GHSA-58qw-p7qm-5rvh", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.osgi/jetty-ee10-osgi-boot-jsp@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:a71f3cd9-f552-5da2-b732-a2974a95b5bf", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10.osgi:jetty-ee10-osgi-boot-jsp." } } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10.osgi/jetty-ee10-osgi-boot-jsp@12.0.22-tuxcare.1" } ] }