{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e90ebf74-bac0-5832-b25e-67059401b0d5", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "jetty-ee9-annotations", "purl": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-annotations@12.0.22-tuxcare.1", "type": "library", "group": "org.eclipse.jetty.ee9", "bom-ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-annotations@12.0.22-tuxcare.1", "version": "12.0.22-tuxcare.1", "pedigree": { "ancestors": [ { "name": "jetty-ee9-annotations", "purl": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-annotations@12.0.22", "type": "library", "group": "org.eclipse.jetty.ee9", "version": "12.0.22" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2006-6969", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:ed4f405a-1df8-57da-9d4e-d289b1e90317", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2006-6969 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-annotations." } }, { "id": "CVE-2007-1651", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:b07d11ed-23ed-53b2-8c15-e5723b66d102", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2007-1651 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-annotations. Target Jetty 12.0.22 is NOT affected. The CVE concerns a CSRF / session-restoration weakness in Jetty's OpenID Connect support; the two vendor patches (5f2c96dc, 2020 \u2014 move ID-token expiry to initial-auth-only + proper logout/validate delegation; e9f260f4, 2021 \u2014 replace the single anti-forgery CSRF token with a per-session, SecureRandom-keyed csrfMap and mandatory `state` validation) are UPSTREAM Jetty fixes authored by lachlan@webtide.com years before the 12.0.22 release (June 2025). Both fix commits are ancestors of HEAD, and the shipped jetty-core/jetty-openid and jetty-ee9/jetty-ee9-openid modules contain the complete post-fix code. The pre-fix vulnerable pattern (single CSRF_TOKEN setAttribute, isExpired() gating session validity, empty logout()) is absent. Not a TuxCare backport \u2014 the fix is native/upstream, so verdict is not_affected (justification code_not_present), not already_fixed.", "justification": "code_not_present" } }, { "id": "CVE-2007-1652", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:de06902b-411f-5889-bfc6-eb8b5b908326", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2007-1652 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-annotations." } }, { "id": "CVE-2011-4461", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:b87372e8-650b-5f0a-92d2-535d1a756a8c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-4461 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-annotations." } }, { "id": "CVE-2015-2080", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:28b9c69c-da29-5988-b3e0-d62e0280d665", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-2080 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-annotations." } }, { "id": "CVE-2016-4800", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:55b176d5-a75d-58b6-9922-1c8ccaa9cadf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-4800 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-annotations." } }, { "id": "CVE-2017-7656", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:4b5742b4-45b5-51e1-8460-1650dd03b0ae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7656 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-annotations." } }, { "id": "CVE-2017-7657", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:4919ce21-a9e1-593a-9b69-7bffe1cc8b9e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7657 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-annotations." } }, { "id": "CVE-2017-7658", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:ea3f9a5a-c66f-5403-9018-635311b25c13", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7658 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-annotations." } }, { "id": "CVE-2017-9735", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:52e1e7f1-2272-52bd-bccb-bf303b9ad766", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-9735 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-annotations." } }, { "id": "CVE-2018-12536", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:ccf40b2f-1dd6-50cd-b014-920b6c3adda0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12536 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-annotations." } }, { "id": "CVE-2018-12538", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:16280050-aff4-5cc3-86e5-561600008ade", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12538 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-annotations." } }, { "id": "CVE-2018-12545", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:872c0afe-150b-5e45-96f1-d85728685963", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12545 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-annotations." } }, { "id": "CVE-2019-10241", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:ece57db7-6532-56f1-b6c3-7f11999fae54", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10241 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-annotations." } }, { "id": "CVE-2019-10246", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:9ea557f8-7285-54e5-8c5b-9f5eeb28681d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10246 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-annotations." } }, { "id": "CVE-2019-10247", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:43bf10d4-3a48-5d1e-84c1-4662777f36c9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10247 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-annotations." } }, { "id": "CVE-2019-17632", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:bfe75de0-185d-547d-9d40-6d90147c1500", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17632 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-annotations." } }, { "id": "CVE-2019-17638", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:439acc1f-209d-5516-ae9e-766550e9d165", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17638 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-annotations." } }, { "id": "CVE-2020-27218", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:05376e9c-2e98-5794-822a-612ac1a69698", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27218 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-annotations." } }, { "id": "CVE-2020-27223", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:f8e68323-9b5e-5bf0-9773-5fca0da5aac5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27223 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-annotations." } }, { "id": "CVE-2021-28165", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:36eaafc8-f946-5282-ba05-46b8d1a8fa83", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28165 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-annotations." } }, { "id": "CVE-2021-34428", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:03bbb0b6-6cac-57d7-8ba1-423d35d3154d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-annotations." } }, { "id": "CVE-2022-2047", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:d7114487-7621-5f8b-9073-770cc227f7d5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2047 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-annotations." } }, { "id": "CVE-2022-2191", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:e06b9584-c915-5108-86ea-c49bfa5ce83f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2191 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-annotations." } }, { "id": "CVE-2023-26048", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:15fd3f33-6445-592d-b4f2-44f79fabd9a2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26048 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-annotations." } }, { "id": "CVE-2023-26049", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:67e63c25-96a9-5b9e-a9e0-2c05d4546d5f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26049 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-annotations." } }, { "id": "CVE-2023-40167", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:698a2a2b-d6e8-54f9-9d96-65290459a17e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-40167 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-annotations." } }, { "id": "CVE-2024-13009", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:3fb40913-8732-5be7-b72f-792d7e5cecf9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-13009 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-annotations." } }, { "id": "CVE-2024-6763", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:f3a3d91b-c0c0-528d-8cb0-1348a34cdb89", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-annotations." } }, { "id": "CVE-2024-7708", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:5bda5e11-2301-5a48-9ebd-e528f9478aed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7708 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-annotations." } }, { "id": "CVE-2024-8184", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:40ece126-3279-58af-bec4-ca64918872d6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-annotations." } }, { "id": "CVE-2025-11143", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:9a8cf5da-5b2a-5f40-8bac-596860a398b5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-annotations." } }, { "id": "CVE-2026-10050", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:471f88db-aae9-527a-9686-c749049517bd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-10050 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-annotations." } }, { "id": "CVE-2026-10051", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:22e47d4a-5b56-5b78-b79f-30991e0d8a81", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10051 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-annotations." } }, { "id": "CVE-2026-1605", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:6b78e74a-5cce-5953-a4ec-feb50c14dc43", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1605 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-annotations." } }, { "id": "CVE-2026-18659", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:c68d174a-d223-5a96-9448-ae3c3c04e884", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18659 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-annotations." } }, { "id": "CVE-2026-18660", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:37d6877f-69bb-5176-b9f0-9f9998fb46f0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18660 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-annotations." } }, { "id": "CVE-2026-18661", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:d05a9276-fb6f-549e-8308-710c6a813c44", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18661 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-annotations." } }, { "id": "CVE-2026-18662", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:a1af9352-ed61-5f59-be06-064f8d1067a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18662 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-annotations." } }, { "id": "CVE-2026-19864", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:4bb1a2bf-cfe1-5108-a56a-77372442c323", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-19864 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-annotations." } }, { "id": "CVE-2026-2332", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:7879944b-c6f9-500b-b892-02952bab9db3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-2332 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-annotations." } }, { "id": "CVE-2026-6790", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:06e35e38-8b75-5a4c-8b7d-b6df4b0ea2c3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6790 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-annotations." } }, { "id": "CVE-2026-8384", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:fa164661-a59b-5d76-ac03-564afdf4b709", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-8384 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-annotations." } }, { "id": "GHSA-58qw-p7qm-5rvh", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-annotations@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:31f8c4bf-5524-565b-bf0c-081dfe6262e6", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-annotations." } } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-annotations@12.0.22-tuxcare.1" } ] }