{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:727fdaa4-af7b-5434-98f3-6d66bc30e860", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "jetty-ee8-annotations", "purl": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-annotations@12.0.22-tuxcare.1", "type": "library", "group": "org.eclipse.jetty.ee8", "bom-ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-annotations@12.0.22-tuxcare.1", "version": "12.0.22-tuxcare.1", "pedigree": { "ancestors": [ { "name": "jetty-ee8-annotations", "purl": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-annotations@12.0.22", "type": "library", "group": "org.eclipse.jetty.ee8", "version": "12.0.22" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2006-6969", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:1867a297-bd2b-514f-b116-32cfc03655f4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2006-6969 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-annotations." } }, { "id": "CVE-2007-1651", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:59cea0f6-9df4-5b6b-993e-8ddbd43fc47e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2007-1651 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-annotations. Target Jetty 12.0.22 is NOT affected. The CVE concerns a CSRF / session-restoration weakness in Jetty's OpenID Connect support; the two vendor patches (5f2c96dc, 2020 \u2014 move ID-token expiry to initial-auth-only + proper logout/validate delegation; e9f260f4, 2021 \u2014 replace the single anti-forgery CSRF token with a per-session, SecureRandom-keyed csrfMap and mandatory `state` validation) are UPSTREAM Jetty fixes authored by lachlan@webtide.com years before the 12.0.22 release (June 2025). Both fix commits are ancestors of HEAD, and the shipped jetty-core/jetty-openid and jetty-ee9/jetty-ee9-openid modules contain the complete post-fix code. The pre-fix vulnerable pattern (single CSRF_TOKEN setAttribute, isExpired() gating session validity, empty logout()) is absent. Not a TuxCare backport \u2014 the fix is native/upstream, so verdict is not_affected (justification code_not_present), not already_fixed.", "justification": "code_not_present" } }, { "id": "CVE-2007-1652", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:bd823a71-7bb2-5b05-8d0b-56833dd67ea8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2007-1652 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-annotations." } }, { "id": "CVE-2011-4461", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:dc66a27a-0487-50c9-86ce-2c32e7bd748d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-4461 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-annotations." } }, { "id": "CVE-2015-2080", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:eedf1082-6a3e-5e78-a9cc-7c761e75ca76", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-2080 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-annotations." } }, { "id": "CVE-2016-4800", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:7aeb9877-59d1-5d69-a3f8-97f6aa56f26a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-4800 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-annotations." } }, { "id": "CVE-2017-7656", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:24b9a6d7-9f6e-5dc3-aa6b-6934d16a502c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7656 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-annotations." } }, { "id": "CVE-2017-7657", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:24759092-40c6-5d59-9e0a-7c297b1fdc4a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7657 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-annotations." } }, { "id": "CVE-2017-7658", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:bfee9237-4a9f-5069-b549-7ae927472f13", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7658 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-annotations." } }, { "id": "CVE-2017-9735", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:e8ed6955-8b76-5dcd-bcba-18c25f8db4c6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-9735 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-annotations." } }, { "id": "CVE-2018-12536", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:3d610d5f-ce8f-5250-917e-5b5781aec1e9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12536 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-annotations." } }, { "id": "CVE-2018-12538", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:a4a25af0-6e82-5322-99b6-1acc457c85f8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12538 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-annotations." } }, { "id": "CVE-2018-12545", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:800a7baf-1e73-5958-b8df-b8957f7369fb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12545 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-annotations." } }, { "id": "CVE-2019-10241", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:86314062-1df8-51cd-a214-b1046465fa0e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10241 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-annotations." } }, { "id": "CVE-2019-10246", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:c58a3484-0a8e-5dd9-a416-0a18cb45e16f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10246 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-annotations." } }, { "id": "CVE-2019-10247", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:4553955e-f2f5-579b-b833-12bcbdfa3f0e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10247 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-annotations." } }, { "id": "CVE-2019-17632", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:15c0d613-6736-52f1-a847-21552c0f243b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17632 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-annotations." } }, { "id": "CVE-2019-17638", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:50a4a294-ed20-51fd-bc55-906a12c7f63d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17638 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-annotations." } }, { "id": "CVE-2020-27218", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:023053c3-cbcc-5af7-a5e9-445c37f2e2d1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27218 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-annotations." } }, { "id": "CVE-2020-27223", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:d2115c65-bcd6-510f-a0f1-86c3761c6d77", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27223 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-annotations." } }, { "id": "CVE-2021-28165", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:bb02576f-b612-53bb-85bb-21fdf4df6f2b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28165 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-annotations." } }, { "id": "CVE-2021-34428", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:0faf7f76-994f-523c-9361-026160de82b1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-annotations." } }, { "id": "CVE-2022-2047", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:19cc8765-c504-59a7-8150-d39716f0ce42", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2047 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-annotations." } }, { "id": "CVE-2022-2191", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:3d8fcaeb-e968-53ee-9ecd-11f38092642e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2191 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-annotations." } }, { "id": "CVE-2023-26048", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:c2cc5de6-0dcd-547c-b25a-c0c7d4fb4cfb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26048 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-annotations." } }, { "id": "CVE-2023-26049", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:421ef81c-ff3c-5952-a6a2-3d3a33cbb9a7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26049 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-annotations." } }, { "id": "CVE-2023-40167", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:f2d48e8d-031c-5209-87d2-2e96b1fbf354", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-40167 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-annotations." } }, { "id": "CVE-2024-13009", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:79e81f04-7b7a-5e70-9932-5cabea29f496", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-13009 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-annotations." } }, { "id": "CVE-2024-6763", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:db96927d-865f-5276-85e5-8b55834ef2ab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-annotations." } }, { "id": "CVE-2024-7708", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:c5dd0191-a862-5a23-93a8-7dfdbf4602c8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7708 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-annotations." } }, { "id": "CVE-2024-8184", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:7134b961-1ff3-5320-8c71-f6e8214eb6c7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-annotations." } }, { "id": "CVE-2025-11143", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:b91c1e33-ddcc-5e3c-aa71-ee43ffab8da1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-annotations." } }, { "id": "CVE-2026-10050", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:63ce444e-c431-52c9-b8b8-4f3a00b1b218", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-10050 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-annotations." } }, { "id": "CVE-2026-10051", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:c63fbd6e-aa72-526c-a08a-3b53715cba88", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10051 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-annotations." } }, { "id": "CVE-2026-1605", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:a1ff659a-30fc-5b7f-a66c-aaea199eac00", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1605 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-annotations." } }, { "id": "CVE-2026-18659", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:551f60cc-ceff-5b90-8a74-40560aae34ba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18659 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-annotations." } }, { "id": "CVE-2026-18660", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:c92c7086-09d1-5605-9b5f-2faeac1384d7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18660 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-annotations." } }, { "id": "CVE-2026-18661", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:5ed1d684-0720-5f69-a083-5727c36fbee2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18661 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-annotations." } }, { "id": "CVE-2026-18662", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:fac9ee40-9c6c-5c78-9c5d-50f3f3445214", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18662 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-annotations." } }, { "id": "CVE-2026-19864", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:19cbc205-7728-5095-99d3-aaebc2ae6d97", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-19864 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-annotations." } }, { "id": "CVE-2026-2332", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:4a97e9ca-b024-577e-addd-33007fcb15d9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-2332 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-annotations." } }, { "id": "CVE-2026-6790", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:344b9973-c877-5120-a307-073a22f1409b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6790 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-annotations." } }, { "id": "CVE-2026-8384", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:16bff049-de29-514f-a2a5-d4bfc07097fd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-8384 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-annotations." } }, { "id": "GHSA-58qw-p7qm-5rvh", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:65ac56ed-4208-553d-a6a4-47d3fa4df695", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-annotations." } } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-annotations@12.0.22-tuxcare.1" } ] }