{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:b54d8136-6c70-53cb-a69b-e99e843c8ac2", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "jetty-ee10-runner", "purl": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-runner@12.0.22-tuxcare.1", "type": "library", "group": "org.eclipse.jetty.ee10", "bom-ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-runner@12.0.22-tuxcare.1", "version": "12.0.22-tuxcare.1", "pedigree": { "ancestors": [ { "name": "jetty-ee10-runner", "purl": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-runner@12.0.22", "type": "library", "group": "org.eclipse.jetty.ee10", "version": "12.0.22" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2006-6969", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-runner@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:ecab854c-1c98-51de-abbe-fd83436064d8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2006-6969 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-runner." } }, { "id": "CVE-2007-1651", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-runner@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:799a62cd-247b-5aa4-85f7-5e6eb9215eb4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2007-1651 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-runner. Target Jetty 12.0.22 is NOT affected. The CVE concerns a CSRF / session-restoration weakness in Jetty's OpenID Connect support; the two vendor patches (5f2c96dc, 2020 \u2014 move ID-token expiry to initial-auth-only + proper logout/validate delegation; e9f260f4, 2021 \u2014 replace the single anti-forgery CSRF token with a per-session, SecureRandom-keyed csrfMap and mandatory `state` validation) are UPSTREAM Jetty fixes authored by lachlan@webtide.com years before the 12.0.22 release (June 2025). Both fix commits are ancestors of HEAD, and the shipped jetty-core/jetty-openid and jetty-ee9/jetty-ee9-openid modules contain the complete post-fix code. The pre-fix vulnerable pattern (single CSRF_TOKEN setAttribute, isExpired() gating session validity, empty logout()) is absent. Not a TuxCare backport \u2014 the fix is native/upstream, so verdict is not_affected (justification code_not_present), not already_fixed.", "justification": "code_not_present" } }, { "id": "CVE-2007-1652", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-runner@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:46276a1c-3d2d-5a81-ad26-9b9e9dd692c6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2007-1652 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-runner." } }, { "id": "CVE-2011-4461", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-runner@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:8fa87ab4-c695-53c6-862c-207a69551f7d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-4461 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-runner." } }, { "id": "CVE-2015-2080", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-runner@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:9eacadc4-1ed4-5460-a5ad-73ec0e3ae72a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-2080 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-runner." } }, { "id": "CVE-2016-4800", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-runner@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:4056d46d-1afd-55d0-b10e-2eae9cc7305b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-4800 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-runner." } }, { "id": "CVE-2017-7656", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-runner@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:e7b96d43-45cb-5e5f-bc3e-d187ffebf867", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7656 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-runner." } }, { "id": "CVE-2017-7657", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-runner@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:a686a9e7-89eb-5c3c-9c12-4d784f574394", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7657 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-runner." } }, { "id": "CVE-2017-7658", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-runner@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:cabf3521-34ca-52f3-8114-6d1a30771faa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7658 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-runner." } }, { "id": "CVE-2017-9735", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-runner@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:ef30ebb3-6d32-5371-ad41-a5b31d526084", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-9735 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-runner." } }, { "id": "CVE-2018-12536", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-runner@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:b5cecb40-4e69-5d89-b863-51de45d5b430", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12536 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-runner." } }, { "id": "CVE-2018-12538", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-runner@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:ff1d6a8f-1823-57ad-85b7-2d4ed56e3cc4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12538 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-runner." } }, { "id": "CVE-2018-12545", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-runner@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:ce20a80a-9ad9-55af-81ea-f421acb17e91", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12545 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-runner." } }, { "id": "CVE-2019-10241", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-runner@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:e1d6d872-4de4-529a-b303-ee6e298b7a3e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10241 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-runner." } }, { "id": "CVE-2019-10246", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-runner@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:55a5877c-358d-5338-b7cf-0ef0ec1029dd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10246 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-runner." } }, { "id": "CVE-2019-10247", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-runner@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:ba02bd4a-4abd-5c07-9f8c-882e4f406f9f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10247 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-runner." } }, { "id": "CVE-2019-17632", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-runner@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:9f7944fc-dd9c-5d22-bafb-b20d51a67637", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17632 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-runner." } }, { "id": "CVE-2019-17638", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-runner@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:98f32f7a-aa3c-5a7a-9395-7a4713af63dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17638 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-runner." } }, { "id": "CVE-2020-27218", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-runner@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:d7c7e6f9-05da-5582-9359-fe7023fac3f3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27218 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-runner." } }, { "id": "CVE-2020-27223", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-runner@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:4cb811f1-fe81-51d9-9aff-79d9ec229dcc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27223 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-runner." } }, { "id": "CVE-2021-28165", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-runner@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:3fcc75a2-d2be-53fb-a656-cefb98e6c4d7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28165 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-runner." } }, { "id": "CVE-2021-34428", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-runner@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:f57e277e-02c1-5942-955f-22572a110b8a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-runner." } }, { "id": "CVE-2022-2047", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-runner@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:48452502-bda0-5879-bfdc-f92728c63c46", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2047 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-runner." } }, { "id": "CVE-2022-2191", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-runner@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:1a2322d7-06a4-59b3-ba40-d847a7d3b215", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2191 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-runner." } }, { "id": "CVE-2023-26048", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-runner@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:43d9a8e2-4ebe-5c92-b45e-6ad8f6b55451", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26048 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-runner." } }, { "id": "CVE-2023-26049", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-runner@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:35ab32dc-9a75-5f25-a8ef-8aedaf44aaa4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26049 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-runner." } }, { "id": "CVE-2023-40167", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-runner@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:efac53db-ba58-5b2d-b88d-3716bd00d57f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-40167 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-runner." } }, { "id": "CVE-2024-13009", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-runner@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:39ac05c1-c2db-5c56-9e63-76933b88a4cd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-13009 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-runner." } }, { "id": "CVE-2024-6763", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-runner@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:5ce71ace-2c03-5bbb-8dfd-71919a525e95", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-runner." } }, { "id": "CVE-2024-7708", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-runner@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:b1901de9-f801-5405-a8cc-ef1f3b84985c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7708 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-runner." } }, { "id": "CVE-2024-8184", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-runner@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:198e199a-48ac-59b4-a298-8d0e8fc4b62c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-runner." } }, { "id": "CVE-2025-11143", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-runner@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:6d325451-120a-5a28-8cfd-df047363c248", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-runner." } }, { "id": "CVE-2026-10050", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-runner@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:9e10dabb-ac91-5224-92cc-fe73052a278e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-10050 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-runner." } }, { "id": "CVE-2026-10051", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-runner@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:1e0bb03b-2ae7-5bda-b120-073b855b965c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10051 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-runner." } }, { "id": "CVE-2026-1605", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-runner@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:7860f1e2-38fa-543c-8087-5ae5b7332c58", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1605 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-runner." } }, { "id": "CVE-2026-18659", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-runner@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:562a51c1-dc51-5502-8f7d-ec0771b5279f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18659 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-runner." } }, { "id": "CVE-2026-18660", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-runner@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:3beef847-7305-52ee-8c59-f5cf4b65de78", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18660 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-runner." } }, { "id": "CVE-2026-18661", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-runner@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:1d93095a-cd08-5f60-b2a7-1e0be48c2402", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18661 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-runner." } }, { "id": "CVE-2026-18662", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-runner@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:922f4a88-be36-532c-90b6-6149c02004bf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18662 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-runner." } }, { "id": "CVE-2026-19864", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-runner@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:da8799c1-3509-5e3a-95ee-14e812121606", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-19864 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-runner." } }, { "id": "CVE-2026-2332", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-runner@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:e328f293-6ebe-5f83-a0dd-44a757f90e41", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-2332 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-runner." } }, { "id": "CVE-2026-6790", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-runner@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:947ba07d-7f5d-5022-a284-8a2985bd265f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6790 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-runner." } }, { "id": "CVE-2026-8384", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-runner@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:311cc8f6-6edf-5b43-bbc5-76017418315d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-8384 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-runner." } }, { "id": "GHSA-58qw-p7qm-5rvh", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-runner@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:c61e1105-1827-5410-a119-8b3170b5aa6e", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee10:jetty-ee10-runner." } } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.ee10/jetty-ee10-runner@12.0.22-tuxcare.1" } ] }