{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3861d86a-ed0a-5216-97d0-47b0f751fc67", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "jetty-ee10-annotations", "purl": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-annotations@12.0.22-tuxcare.1", "type": "library", "group": "org.eclipse.jetty.ee10", "bom-ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-annotations@12.0.22-tuxcare.1", "version": "12.0.22-tuxcare.1", "pedigree": { "ancestors": [ { "name": "jetty-ee10-annotations", "purl": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-annotations@12.0.22", "type": "library", "group": "org.eclipse.jetty.ee10", "version": "12.0.22" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2006-6969", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:2daecf96-42fd-52ff-84d9-d520a6db201d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2006-6969 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-annotations." } }, { "id": "CVE-2007-1651", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:4729b61e-11ac-513b-bd35-8ab8463704a5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2007-1651 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-annotations. Target Jetty 12.0.22 is NOT affected. The CVE concerns a CSRF / session-restoration weakness in Jetty's OpenID Connect support; the two vendor patches (5f2c96dc, 2020 \u2014 move ID-token expiry to initial-auth-only + proper logout/validate delegation; e9f260f4, 2021 \u2014 replace the single anti-forgery CSRF token with a per-session, SecureRandom-keyed csrfMap and mandatory `state` validation) are UPSTREAM Jetty fixes authored by lachlan@webtide.com years before the 12.0.22 release (June 2025). Both fix commits are ancestors of HEAD, and the shipped jetty-core/jetty-openid and jetty-ee9/jetty-ee9-openid modules contain the complete post-fix code. The pre-fix vulnerable pattern (single CSRF_TOKEN setAttribute, isExpired() gating session validity, empty logout()) is absent. Not a TuxCare backport \u2014 the fix is native/upstream, so verdict is not_affected (justification code_not_present), not already_fixed.", "justification": "code_not_present" } }, { "id": "CVE-2007-1652", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:bd012350-d667-5475-8d82-8dd8d46bdefe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2007-1652 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-annotations." } }, { "id": "CVE-2011-4461", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:3ff33ec8-3c73-53c2-9b72-cba56f8cefa1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-4461 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-annotations." } }, { "id": "CVE-2015-2080", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:da0ceebe-4425-5fc1-b692-ab15c41aea99", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-2080 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-annotations." } }, { "id": "CVE-2016-4800", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:79288bde-aec2-5d1f-9911-070e0a7d31a8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-4800 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-annotations." } }, { "id": "CVE-2017-7656", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:f6a106bb-c1aa-5cd3-89e7-9eb6837f8d03", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7656 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-annotations." } }, { "id": "CVE-2017-7657", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:ee452ff9-c275-592c-be59-2b45769582cf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7657 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-annotations." } }, { "id": "CVE-2017-7658", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:8fda1641-00fc-5958-894b-1ba74dc6ef3d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7658 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-annotations." } }, { "id": "CVE-2017-9735", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:525ccc03-6705-5821-ba58-9dc9970f7b3a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-9735 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-annotations." } }, { "id": "CVE-2018-12536", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:b5113ef0-2112-503e-9dac-a604fda6ddcc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12536 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-annotations." } }, { "id": "CVE-2018-12538", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:b493226d-0e22-5991-8044-5ffca1cc2722", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12538 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-annotations." } }, { "id": "CVE-2018-12545", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:312fef6a-13e0-5eb3-95d4-7c7b36c4f601", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12545 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-annotations." } }, { "id": "CVE-2019-10241", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:a4e4001d-b445-508b-bd80-3d93f97ec414", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10241 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-annotations." } }, { "id": "CVE-2019-10246", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:d1cc7628-41e9-5063-80db-8d44786a370b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10246 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-annotations." } }, { "id": "CVE-2019-10247", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:31cd8878-d000-52fc-bc3e-7073818e63c9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10247 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-annotations." } }, { "id": "CVE-2019-17632", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:5876309a-d955-5f8f-996c-770259b6bf81", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17632 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-annotations." } }, { "id": "CVE-2019-17638", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:f27dfa1e-6e5f-5137-a1d8-311332c17ea6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17638 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-annotations." } }, { "id": "CVE-2020-27218", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:68d6999f-2f7e-5c3b-88e6-a8a742f3f769", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27218 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-annotations." } }, { "id": "CVE-2020-27223", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:c24b0371-e99f-5ec5-9f34-a7deebfeda87", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27223 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-annotations." } }, { "id": "CVE-2021-28165", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:59e5fde1-07fe-5ecb-b180-5103e0ae6c48", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28165 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-annotations." } }, { "id": "CVE-2021-34428", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:b1d6c6b3-24a4-5458-9b6e-ed1c2d95a73c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-annotations." } }, { "id": "CVE-2022-2047", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:061d9880-5edd-523d-bba4-a9acd4b9ad0d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2047 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-annotations." } }, { "id": "CVE-2022-2191", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:0c92f52a-e652-5c6c-b6ab-39ae675c595c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2191 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-annotations." } }, { "id": "CVE-2023-26048", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:529740a1-c597-5aca-9003-122d67adecb0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26048 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-annotations." } }, { "id": "CVE-2023-26049", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:3d5b63b3-7e4e-51c5-a782-e73d663c3932", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26049 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-annotations." } }, { "id": "CVE-2023-40167", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:4b8b735f-6891-522f-9347-5108d5dad398", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-40167 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-annotations." } }, { "id": "CVE-2024-13009", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:1893889f-8e5d-513a-85be-0931cb0911f2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-13009 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-annotations." } }, { "id": "CVE-2024-6763", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:cbb5d211-a2f6-50fe-8a30-8404db275a9e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-annotations." } }, { "id": "CVE-2024-7708", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:e70a7d77-6c1d-5c04-89f4-a33a9e7e6da4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7708 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-annotations." } }, { "id": "CVE-2024-8184", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:7017ee7a-7714-534e-97ef-1ef32019295a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-annotations." } }, { "id": "CVE-2025-11143", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:0f86d24e-3030-51c5-8b48-ea44cb5a89f3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-annotations." } }, { "id": "CVE-2026-10050", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:083f6a65-a85c-50e5-afb4-0c389254e372", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-10050 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-annotations." } }, { "id": "CVE-2026-10051", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:83c5b934-8ba3-51cb-b4f1-d4cb215037a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10051 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-annotations." } }, { "id": "CVE-2026-1605", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:662dd46d-06d8-5368-90cd-56d44795d5af", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1605 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-annotations." } }, { "id": "CVE-2026-18659", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:3b67b411-74e7-5ff0-a238-ff5651c59962", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18659 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-annotations." } }, { "id": "CVE-2026-18660", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:84e92a95-5c39-5b5d-9a3c-ec017dfaff3d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18660 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-annotations." } }, { "id": "CVE-2026-18661", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:a2cf396a-f9eb-50d9-bc99-9ddc01e91ad8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18661 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-annotations." } }, { "id": "CVE-2026-18662", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:16b9ca3b-da34-5e05-bfc2-282ba665f158", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18662 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-annotations." } }, { "id": "CVE-2026-19864", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:2df39224-7adc-5441-94f5-bee58d67ac4c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-19864 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-annotations." } }, { "id": "CVE-2026-2332", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:f52eb483-c343-509d-ad63-7185015cab2e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-2332 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-annotations." } }, { "id": "CVE-2026-6790", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:5f17839a-d35d-567d-8e29-6dd7ac7c40ef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6790 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-annotations." } }, { "id": "CVE-2026-8384", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:0579e645-0292-5073-bdf5-8e7e41dd3118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-8384 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-annotations." } }, { "id": "GHSA-58qw-p7qm-5rvh", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:aca37afb-1599-5d8a-a35d-a40f7cdad764", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-annotations." } } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-annotations@12.0.22-tuxcare.1" } ] }