{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8e18cd41-c7e1-5192-a215-c889d00f1e32", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "jetty-ee8-maven-plugin", "purl": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-maven-plugin@12.0.22-tuxcare.1", "type": "library", "group": "org.eclipse.jetty.ee8", "bom-ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-maven-plugin@12.0.22-tuxcare.1", "version": "12.0.22-tuxcare.1", "pedigree": { "ancestors": [ { "name": "jetty-ee8-maven-plugin", "purl": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-maven-plugin@12.0.22", "type": "library", "group": "org.eclipse.jetty.ee8", "version": "12.0.22" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2006-6969", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-maven-plugin@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:ae0ecf19-6f92-52d1-ab20-3dcb6edb7609", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2006-6969 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-maven-plugin." } }, { "id": "CVE-2007-1651", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-maven-plugin@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:a1b1b52c-6766-5681-abf5-9a3c109ed1b2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2007-1651 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-maven-plugin. Target Jetty 12.0.22 is NOT affected. The CVE concerns a CSRF / session-restoration weakness in Jetty's OpenID Connect support; the two vendor patches (5f2c96dc, 2020 \u2014 move ID-token expiry to initial-auth-only + proper logout/validate delegation; e9f260f4, 2021 \u2014 replace the single anti-forgery CSRF token with a per-session, SecureRandom-keyed csrfMap and mandatory `state` validation) are UPSTREAM Jetty fixes authored by lachlan@webtide.com years before the 12.0.22 release (June 2025). Both fix commits are ancestors of HEAD, and the shipped jetty-core/jetty-openid and jetty-ee9/jetty-ee9-openid modules contain the complete post-fix code. The pre-fix vulnerable pattern (single CSRF_TOKEN setAttribute, isExpired() gating session validity, empty logout()) is absent. Not a TuxCare backport \u2014 the fix is native/upstream, so verdict is not_affected (justification code_not_present), not already_fixed.", "justification": "code_not_present" } }, { "id": "CVE-2007-1652", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-maven-plugin@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:bbfd9d16-af97-5507-829b-47782c94d48d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2007-1652 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-maven-plugin." } }, { "id": "CVE-2011-4461", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-maven-plugin@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:4c77b074-d293-5e68-ba16-87397dac074a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-4461 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-maven-plugin." } }, { "id": "CVE-2015-2080", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-maven-plugin@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:6dd46924-4b6a-58b1-a1f1-3e59aa01b73b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-2080 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-maven-plugin." } }, { "id": "CVE-2016-4800", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-maven-plugin@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:8083361c-4387-55ce-88e2-74f974e305a4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-4800 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-maven-plugin." } }, { "id": "CVE-2017-7656", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-maven-plugin@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:4fd957c9-682b-5e3e-8af2-3ae08da9021a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7656 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-maven-plugin." } }, { "id": "CVE-2017-7657", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-maven-plugin@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:b7df5667-ffb9-595c-a81d-c8f7c40ff567", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7657 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-maven-plugin." } }, { "id": "CVE-2017-7658", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-maven-plugin@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:ad7e9924-da32-540e-9baf-1a3562bdae1d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7658 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-maven-plugin." } }, { "id": "CVE-2017-9735", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-maven-plugin@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:c26bc86b-7bef-54e7-a4cb-5704e293f07f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-9735 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-maven-plugin." } }, { "id": "CVE-2018-12536", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-maven-plugin@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:3eddb1c8-b6c2-5bee-b325-a6c7a6c1767c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12536 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-maven-plugin." } }, { "id": "CVE-2018-12538", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-maven-plugin@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:d086096c-b232-5260-a773-d105dfaaf339", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12538 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-maven-plugin." } }, { "id": "CVE-2018-12545", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-maven-plugin@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:88426339-20c1-59f8-b772-f03714e6c1a8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12545 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-maven-plugin." } }, { "id": "CVE-2019-10241", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-maven-plugin@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:69825d5d-755a-5d32-a039-c9d98385ea5d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10241 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-maven-plugin." } }, { "id": "CVE-2019-10246", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-maven-plugin@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:45902735-9cde-55c6-97b0-05350c28e469", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10246 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-maven-plugin." } }, { "id": "CVE-2019-10247", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-maven-plugin@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:4cfb9fbc-84fe-5abe-91e3-d9c9e3e97623", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10247 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-maven-plugin." } }, { "id": "CVE-2019-17632", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-maven-plugin@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:64a3a874-0b51-5322-9d36-a6862f551187", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17632 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-maven-plugin." } }, { "id": "CVE-2019-17638", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-maven-plugin@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:1e28f350-2dc7-5e36-879e-6001012e939d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17638 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-maven-plugin." } }, { "id": "CVE-2020-27218", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-maven-plugin@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:07bce325-f9d0-57c6-9a86-387d791327b8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27218 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-maven-plugin." } }, { "id": "CVE-2020-27223", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-maven-plugin@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:a26f796d-5241-5117-a127-2892e4dd35c1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27223 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-maven-plugin." } }, { "id": "CVE-2021-28165", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-maven-plugin@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:acb64bc0-4c47-574c-8122-fb1852f4c472", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28165 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-maven-plugin." } }, { "id": "CVE-2021-34428", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-maven-plugin@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:e2276f13-1d08-5037-82ba-9e1c143ef5d3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-maven-plugin." } }, { "id": "CVE-2022-2047", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-maven-plugin@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:dcd74563-21c7-5396-bf04-dcb7ea7e728c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2047 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-maven-plugin." } }, { "id": "CVE-2022-2191", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-maven-plugin@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:dd0ec90e-ff31-502b-8b4d-3f4bfa87841c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2191 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-maven-plugin." } }, { "id": "CVE-2023-26048", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-maven-plugin@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:54f37bfb-8228-5bae-b41d-440cd19954c4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26048 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-maven-plugin." } }, { "id": "CVE-2023-26049", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-maven-plugin@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:f83cb5a0-2e59-530d-925c-a57a6fcdf86e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26049 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-maven-plugin." } }, { "id": "CVE-2023-40167", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-maven-plugin@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:371529b6-09ff-516c-9461-090930da7d3d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-40167 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-maven-plugin." } }, { "id": "CVE-2024-13009", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-maven-plugin@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:1baa5d00-9c99-521e-9d6b-a01747512f6e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-13009 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-maven-plugin." } }, { "id": "CVE-2024-6763", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-maven-plugin@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:bcae78b7-bb79-52db-88e6-b8bbd98bf4de", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-maven-plugin." } }, { "id": "CVE-2024-7708", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-maven-plugin@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:260b1c93-c636-5e3e-8a73-32b81067da7a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7708 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-maven-plugin." } }, { "id": "CVE-2024-8184", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-maven-plugin@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:b409e8e9-6d9a-5b98-8af3-15ae3f16e6e6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-maven-plugin." } }, { "id": "CVE-2025-11143", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-maven-plugin@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:02756d97-25e2-565d-89ef-ffc55ece78bb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-maven-plugin." } }, { "id": "CVE-2026-10050", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-maven-plugin@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:c92012e1-10d4-52cc-8208-ed894ad156c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-10050 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-maven-plugin." } }, { "id": "CVE-2026-10051", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-maven-plugin@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:627ccb81-cd51-5a42-b73d-39fa8fe8404f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10051 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-maven-plugin." } }, { "id": "CVE-2026-1605", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-maven-plugin@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:791d6d27-7aef-5313-95dd-4a0413023911", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1605 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-maven-plugin." } }, { "id": "CVE-2026-18660", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-maven-plugin@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:190dfdfd-cb32-5c75-aae7-90fa76dd3d8f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18660 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-maven-plugin." } }, { "id": "CVE-2026-19864", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-maven-plugin@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:abd9351c-3aec-503f-bc8a-b3d5baa349dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-19864 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-maven-plugin." } }, { "id": "CVE-2026-2332", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-maven-plugin@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:cf011f03-4269-56b7-b7cb-8837815186df", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-2332 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-maven-plugin." } }, { "id": "CVE-2026-6790", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-maven-plugin@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:52c4b0aa-11ff-51cf-9bf4-9e5caa56e328", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6790 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-maven-plugin." } }, { "id": "CVE-2026-8384", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-maven-plugin@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:409e66bc-da07-52b1-95de-dda9d7edfb3a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-8384 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-maven-plugin." } }, { "id": "GHSA-58qw-p7qm-5rvh", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-maven-plugin@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:0635b62c-5045-59da-81c6-6791049e662b", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-maven-plugin." } } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-maven-plugin@12.0.22-tuxcare.1" } ] }