{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7a8150b2-37ea-5c22-83e4-c3a6f7537e10", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "jetty-ee8-openid", "purl": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-openid@12.0.22-tuxcare.1", "type": "library", "group": "org.eclipse.jetty.ee8", "bom-ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-openid@12.0.22-tuxcare.1", "version": "12.0.22-tuxcare.1", "pedigree": { "ancestors": [ { "name": "jetty-ee8-openid", "purl": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-openid@12.0.22", "type": "library", "group": "org.eclipse.jetty.ee8", "version": "12.0.22" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2006-6969", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:ae051198-9878-569a-8817-dfb32046debc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2006-6969 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-openid." } }, { "id": "CVE-2007-1651", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:acc5f923-45e5-512d-b9a0-38a88280ad72", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2007-1651 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-openid. Target Jetty 12.0.22 is NOT affected. The CVE concerns a CSRF / session-restoration weakness in Jetty's OpenID Connect support; the two vendor patches (5f2c96dc, 2020 \u2014 move ID-token expiry to initial-auth-only + proper logout/validate delegation; e9f260f4, 2021 \u2014 replace the single anti-forgery CSRF token with a per-session, SecureRandom-keyed csrfMap and mandatory `state` validation) are UPSTREAM Jetty fixes authored by lachlan@webtide.com years before the 12.0.22 release (June 2025). Both fix commits are ancestors of HEAD, and the shipped jetty-core/jetty-openid and jetty-ee9/jetty-ee9-openid modules contain the complete post-fix code. The pre-fix vulnerable pattern (single CSRF_TOKEN setAttribute, isExpired() gating session validity, empty logout()) is absent. Not a TuxCare backport \u2014 the fix is native/upstream, so verdict is not_affected (justification code_not_present), not already_fixed.", "justification": "code_not_present" } }, { "id": "CVE-2007-1652", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:a65658df-fd61-53a8-b3df-3a7ea5020b01", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2007-1652 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-openid." } }, { "id": "CVE-2011-4461", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:0c4731b4-d2c3-525b-bf07-1ff3075ed30f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-4461 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-openid." } }, { "id": "CVE-2015-2080", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:5ce5481b-92ee-5bd5-92ce-afb3dcec2a39", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-2080 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-openid." } }, { "id": "CVE-2016-4800", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:7ffaefa1-d4c9-5353-911e-c6b7f6db5e18", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-4800 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-openid." } }, { "id": "CVE-2017-7656", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:4c24279f-db4d-51ea-8b83-e8480bce87cb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7656 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-openid." } }, { "id": "CVE-2017-7657", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:8f1d41d3-611a-5034-89b2-f1c4d2796744", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7657 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-openid." } }, { "id": "CVE-2017-7658", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:030942f8-a271-5147-8211-17ac5536ae14", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7658 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-openid." } }, { "id": "CVE-2017-9735", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:9ed1b992-9ef6-5e3a-bc6f-5092e77e45ed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-9735 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-openid." } }, { "id": "CVE-2018-12536", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:7a3b91c1-fadf-5cb3-8504-c25ecc2b6080", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12536 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-openid." } }, { "id": "CVE-2018-12538", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:afff1b1e-2c8c-5663-be9e-159ceda9fb93", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12538 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-openid." } }, { "id": "CVE-2018-12545", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:93073048-77f4-53b2-a164-e6825b6ed7da", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12545 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-openid." } }, { "id": "CVE-2019-10241", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:32f4321f-9ccd-52e5-aa60-2ba652d2967c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10241 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-openid." } }, { "id": "CVE-2019-10246", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:4cff8505-00e9-50ab-8f0d-492eb568b612", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10246 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-openid." } }, { "id": "CVE-2019-10247", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:1bb1bda3-2c8c-5930-ad83-077631ea5739", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10247 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-openid." } }, { "id": "CVE-2019-17632", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:f420fcf2-746a-5357-b755-c6e2718aa0a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17632 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-openid." } }, { "id": "CVE-2019-17638", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:4f19c03a-e04d-559a-9a98-79bfa14c8107", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17638 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-openid." } }, { "id": "CVE-2020-27218", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:11fb83c3-b840-5510-9a33-a273eb4601ba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27218 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-openid." } }, { "id": "CVE-2020-27223", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:a9f29d5f-2937-5dcb-a35e-5688ffa8dc15", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27223 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-openid." } }, { "id": "CVE-2021-28165", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:6f1ef66d-a051-55d0-8d15-ec49a0ad619e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28165 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-openid." } }, { "id": "CVE-2021-34428", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:2bad6c00-9705-5627-b28b-8f5c4c462388", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-openid." } }, { "id": "CVE-2022-2047", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:276827e1-4c72-5b10-b471-57d69a333101", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2047 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-openid." } }, { "id": "CVE-2022-2191", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:c9ffd858-e435-52b6-b9f0-6886a5aab7df", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2191 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-openid." } }, { "id": "CVE-2023-26048", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:2d5eb2ef-2bdc-5a45-8c11-87942ebc92ec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26048 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-openid." } }, { "id": "CVE-2023-26049", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:beb32a35-9f57-5ada-a8e3-2370c9f97a5a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26049 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-openid." } }, { "id": "CVE-2023-40167", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:1f754b74-51e2-5cd8-9b0f-87707ebd94bd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-40167 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-openid." } }, { "id": "CVE-2023-41900", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:4c3d270f-3b33-5460-b185-ebdf10bbc077", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-41900 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-openid." } }, { "id": "CVE-2024-13009", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:e34af18e-da1c-5734-96d1-5484160854b6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-13009 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-openid." } }, { "id": "CVE-2024-6763", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:9b3836d7-3540-545d-acba-1e5e9c82f0d1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-openid." } }, { "id": "CVE-2024-7708", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:39795a81-79f4-516d-b1f1-7e69e1806219", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7708 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-openid." } }, { "id": "CVE-2024-8184", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:da0e5c85-473f-5102-82f6-12d5c21bbad6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-openid." } }, { "id": "CVE-2025-11143", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:59aef169-401a-5ad8-aa6e-7277ceac4f4a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-openid." } }, { "id": "CVE-2026-10050", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:18a374e9-f099-5016-ad3f-b6e7302c7fb7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-10050 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-openid." } }, { "id": "CVE-2026-10051", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:6847d4fc-60e5-5be1-839c-351552c5b40d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10051 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-openid." } }, { "id": "CVE-2026-1605", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:750172c2-8e65-5ffa-8b79-f3c80af81da3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1605 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-openid." } }, { "id": "CVE-2026-18659", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:bd2fbae4-81e9-5035-bbcf-4d2d30e4234c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18659 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-openid." } }, { "id": "CVE-2026-18660", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:6f076e49-0a6b-5d85-8021-9a4f2a511611", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18660 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-openid." } }, { "id": "CVE-2026-18662", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:14fead77-ffaa-5096-a40b-0199ca174814", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18662 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-openid." } }, { "id": "CVE-2026-19864", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:9411e9fc-cf3f-53eb-b7e4-609f9122395a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-19864 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-openid." } }, { "id": "CVE-2026-2332", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:3ed0979d-02da-5d10-93d2-940bffcb1e4f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-2332 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-openid." } }, { "id": "CVE-2026-6790", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:60bd2b67-c081-5634-8dab-45914acf5439", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6790 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-openid." } }, { "id": "CVE-2026-8384", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:a41fd557-d064-5fbb-98b8-047c4ec8baad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-8384 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8:jetty-ee8-openid." } } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.ee8/jetty-ee8-openid@12.0.22-tuxcare.1" } ] }