{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:abc41932-6e2b-51b3-8c20-f54da3edb91c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "jetty-ee10-cdi", "purl": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-cdi@12.0.22-tuxcare.1", "type": "library", "group": "org.eclipse.jetty.ee10", "bom-ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-cdi@12.0.22-tuxcare.1", "version": "12.0.22-tuxcare.1", "pedigree": { "ancestors": [ { "name": "jetty-ee10-cdi", "purl": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-cdi@12.0.22", "type": "library", "group": "org.eclipse.jetty.ee10", "version": "12.0.22" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2006-6969", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-cdi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:c630babf-858e-5978-a6f0-358517320b2a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2006-6969 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-cdi." } }, { "id": "CVE-2007-1651", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-cdi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:683592cd-8df1-5531-900d-d0d835ea417f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2007-1651 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-cdi. Target Jetty 12.0.22 is NOT affected. The CVE concerns a CSRF / session-restoration weakness in Jetty's OpenID Connect support; the two vendor patches (5f2c96dc, 2020 \u2014 move ID-token expiry to initial-auth-only + proper logout/validate delegation; e9f260f4, 2021 \u2014 replace the single anti-forgery CSRF token with a per-session, SecureRandom-keyed csrfMap and mandatory `state` validation) are UPSTREAM Jetty fixes authored by lachlan@webtide.com years before the 12.0.22 release (June 2025). Both fix commits are ancestors of HEAD, and the shipped jetty-core/jetty-openid and jetty-ee9/jetty-ee9-openid modules contain the complete post-fix code. The pre-fix vulnerable pattern (single CSRF_TOKEN setAttribute, isExpired() gating session validity, empty logout()) is absent. Not a TuxCare backport \u2014 the fix is native/upstream, so verdict is not_affected (justification code_not_present), not already_fixed.", "justification": "code_not_present" } }, { "id": "CVE-2007-1652", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-cdi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:0faf092c-5e9d-5415-b31a-80bf1fba1c84", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2007-1652 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-cdi." } }, { "id": "CVE-2011-4461", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-cdi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:41aa3e92-46b6-51dc-8168-57fe5a9a9c45", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-4461 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-cdi." } }, { "id": "CVE-2015-2080", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-cdi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:81c37850-3850-5b2c-8f36-5b6a942908c3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-2080 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-cdi." } }, { "id": "CVE-2016-4800", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-cdi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:95777d22-0042-5b9a-b9a4-e9a6e1949b40", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-4800 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-cdi." } }, { "id": "CVE-2017-7656", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-cdi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:c0c9d1b2-ba11-503d-b8b0-9b17c8663c76", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7656 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-cdi." } }, { "id": "CVE-2017-7657", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-cdi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:37f004c5-5629-5a95-b133-1ebc53821274", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7657 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-cdi." } }, { "id": "CVE-2017-7658", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-cdi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:8670392b-ec81-5e1d-9fc6-612926fe20d8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7658 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-cdi." } }, { "id": "CVE-2017-9735", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-cdi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:05188204-6076-54fc-80ee-5dfd25ed3a9f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-9735 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-cdi." } }, { "id": "CVE-2018-12536", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-cdi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:0ced80af-7ef2-55b1-b2f1-210cd1724bcb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12536 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-cdi." } }, { "id": "CVE-2018-12538", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-cdi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:a0c51a4e-8912-5cb9-aecb-298881bbb67c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12538 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-cdi." } }, { "id": "CVE-2018-12545", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-cdi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:cae264a9-4bcc-52ca-8dbd-9cf4e1543ac7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12545 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-cdi." } }, { "id": "CVE-2019-10241", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-cdi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:973f24ec-6091-516c-9353-9f7cf8dfdfd7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10241 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-cdi." } }, { "id": "CVE-2019-10246", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-cdi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:45eb0cf1-6e36-5340-b506-f483aead7300", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10246 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-cdi." } }, { "id": "CVE-2019-10247", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-cdi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:5ea6b368-0213-5ec9-82dc-53b9042e1153", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10247 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-cdi." } }, { "id": "CVE-2019-17632", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-cdi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:0f1e3aac-7f2e-5364-8f0e-b2dff17ec8a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17632 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-cdi." } }, { "id": "CVE-2019-17638", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-cdi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:b9353029-a73c-5814-b584-655620d3cf70", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17638 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-cdi." } }, { "id": "CVE-2020-27218", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-cdi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:df5d987d-2f84-5801-98c1-72dca6831dd6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27218 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-cdi." } }, { "id": "CVE-2020-27223", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-cdi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:f6cf5862-5f2d-5c8e-8017-4293e6473536", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27223 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-cdi." } }, { "id": "CVE-2021-28165", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-cdi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:6528868b-f681-59c0-9ee0-119721c0f36b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28165 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-cdi." } }, { "id": "CVE-2021-34428", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-cdi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:b6907cb2-34cb-52f6-821e-17c402151919", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-cdi." } }, { "id": "CVE-2022-2047", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-cdi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:a98e0d4e-97ca-5e63-960b-4f56d0dded53", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2047 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-cdi." } }, { "id": "CVE-2022-2191", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-cdi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:95c99f3c-7b9b-55c5-9d89-4ac99a7542ae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2191 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-cdi." } }, { "id": "CVE-2023-26048", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-cdi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:e41ee877-a086-5c01-98b3-d13c21ffa153", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26048 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-cdi." } }, { "id": "CVE-2023-26049", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-cdi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:4b5c68e6-5169-5378-9384-86404e90b20c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26049 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-cdi." } }, { "id": "CVE-2023-40167", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-cdi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:af0be98a-39dc-5fb4-9c87-306b6fc7fb4d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-40167 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-cdi." } }, { "id": "CVE-2024-13009", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-cdi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:440e496f-3c1f-5bc2-816c-8ba898feb16e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-13009 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-cdi." } }, { "id": "CVE-2024-6763", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-cdi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:540b81c8-8f5b-57f1-9121-6907397ee0b1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-cdi." } }, { "id": "CVE-2024-7708", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-cdi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:a7091cc6-d9c7-58d8-be4b-62877432e74a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7708 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-cdi." } }, { "id": "CVE-2024-8184", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-cdi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:f09ca154-d3e5-524d-91d3-868454016255", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-cdi." } }, { "id": "CVE-2025-11143", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-cdi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:c74a0cfc-39eb-5c84-9c66-9e437d9108ba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-cdi." } }, { "id": "CVE-2026-10050", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-cdi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:47ff8ee7-d526-5fd5-a0f7-aa70d3c40f4d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-10050 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-cdi." } }, { "id": "CVE-2026-10051", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-cdi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:20306bf1-e76a-52ee-96a6-efa19b37358b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10051 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-cdi." } }, { "id": "CVE-2026-1605", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-cdi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:db42e4db-2f4e-5dc2-88a1-909274b64ddb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1605 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-cdi." } }, { "id": "CVE-2026-18659", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-cdi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:f7a68a0b-8ac3-5be9-bd9a-632ac51f1612", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18659 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-cdi." } }, { "id": "CVE-2026-18660", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-cdi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:4eb4375b-3108-5df3-bf80-ea8e9def1b69", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18660 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-cdi." } }, { "id": "CVE-2026-18661", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-cdi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:d79932d1-fab8-5b2c-83e7-ebd919beecf5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18661 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-cdi." } }, { "id": "CVE-2026-18662", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-cdi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:bf4c059d-a834-571a-82a0-e05a7aea0d5c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18662 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-cdi." } }, { "id": "CVE-2026-19864", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-cdi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:b019ba05-9819-559d-88f6-112da4d33fb6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-19864 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-cdi." } }, { "id": "CVE-2026-2332", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-cdi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:84d51329-8452-5adf-a199-96b0fb5a925b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-2332 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-cdi." } }, { "id": "CVE-2026-6790", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-cdi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:7a84b7eb-7886-5e7d-991c-3537390512c1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6790 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-cdi." } }, { "id": "CVE-2026-8384", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-cdi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:fbf809fa-e76f-5c4d-bf1a-af7c4d71dd2c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-8384 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-cdi." } }, { "id": "GHSA-58qw-p7qm-5rvh", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-cdi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:0ab17f81-aece-5515-8348-2fc632ae5fc4", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-cdi." } } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-cdi@12.0.22-tuxcare.1" } ] }