{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:03572b0b-9c38-562c-a842-4c184b022d16", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "jetty-ee9-jaspi", "purl": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-jaspi@12.0.22-tuxcare.1", "type": "library", "group": "org.eclipse.jetty.ee9", "bom-ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-jaspi@12.0.22-tuxcare.1", "version": "12.0.22-tuxcare.1", "pedigree": { "ancestors": [ { "name": "jetty-ee9-jaspi", "purl": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-jaspi@12.0.22", "type": "library", "group": "org.eclipse.jetty.ee9", "version": "12.0.22" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2006-6969", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:a314c106-fabc-529a-9a6a-61deea525a12", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2006-6969 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-jaspi." } }, { "id": "CVE-2007-1651", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:5ee22fc4-b23c-5948-b587-b4bd2a3f8e78", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2007-1651 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-jaspi. Target Jetty 12.0.22 is NOT affected. The CVE concerns a CSRF / session-restoration weakness in Jetty's OpenID Connect support; the two vendor patches (5f2c96dc, 2020 \u2014 move ID-token expiry to initial-auth-only + proper logout/validate delegation; e9f260f4, 2021 \u2014 replace the single anti-forgery CSRF token with a per-session, SecureRandom-keyed csrfMap and mandatory `state` validation) are UPSTREAM Jetty fixes authored by lachlan@webtide.com years before the 12.0.22 release (June 2025). Both fix commits are ancestors of HEAD, and the shipped jetty-core/jetty-openid and jetty-ee9/jetty-ee9-openid modules contain the complete post-fix code. The pre-fix vulnerable pattern (single CSRF_TOKEN setAttribute, isExpired() gating session validity, empty logout()) is absent. Not a TuxCare backport \u2014 the fix is native/upstream, so verdict is not_affected (justification code_not_present), not already_fixed.", "justification": "code_not_present" } }, { "id": "CVE-2007-1652", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:5ccec12b-ecd1-57ca-a83d-722d8a45f052", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2007-1652 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-jaspi." } }, { "id": "CVE-2011-4461", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:641b2908-faff-50ae-b1ae-acff27fbd980", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-4461 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-jaspi." } }, { "id": "CVE-2015-2080", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:b77d1083-932c-562b-b315-83bf1bad89a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-2080 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-jaspi." } }, { "id": "CVE-2016-4800", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:23f745e5-ab79-5416-9129-e436454221ac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-4800 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-jaspi." } }, { "id": "CVE-2017-7656", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:c0f297ca-6f79-56fd-bc3c-2ca3e07c50c5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7656 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-jaspi." } }, { "id": "CVE-2017-7657", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:4594230c-f8f3-5e3a-a515-2e9513d1e669", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7657 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-jaspi." } }, { "id": "CVE-2017-7658", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:7a8fa0b5-62b4-543e-a35f-eb79e4608824", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7658 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-jaspi." } }, { "id": "CVE-2017-9735", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:27e4910d-c229-5a13-86ba-9cb90140a66d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-9735 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-jaspi." } }, { "id": "CVE-2018-12536", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:b9ed9037-d04b-54ca-8837-761628ed18df", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12536 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-jaspi." } }, { "id": "CVE-2018-12538", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:e40f918f-0a00-5ad7-9607-8b0e1d882254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12538 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-jaspi." } }, { "id": "CVE-2018-12545", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:dbe9e979-7e33-50bf-bfdc-2ed64a053692", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12545 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-jaspi." } }, { "id": "CVE-2019-10241", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:fc3892bd-368e-55a3-8ff0-8f7dfc50f741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10241 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-jaspi." } }, { "id": "CVE-2019-10246", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:1371452d-6696-5685-8d6a-42cc82d6f89f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10246 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-jaspi." } }, { "id": "CVE-2019-10247", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:87500c88-9d0e-5a18-95cc-bb6408fd5c02", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10247 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-jaspi." } }, { "id": "CVE-2019-17632", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:47619064-0f5f-546d-9071-5692df485419", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17632 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-jaspi." } }, { "id": "CVE-2019-17638", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:6e3a140a-b104-513f-a50e-4f0b08b69c7a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17638 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-jaspi." } }, { "id": "CVE-2020-27218", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:38658761-baa7-58fc-a2a3-63d667e6ecc8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27218 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-jaspi." } }, { "id": "CVE-2020-27223", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:59e20ba7-d386-5544-b491-36ca0ab1f015", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27223 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-jaspi." } }, { "id": "CVE-2021-28165", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:ef6fe127-6ef7-5038-a83c-4d6b1be7efc3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28165 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-jaspi." } }, { "id": "CVE-2021-34428", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:4b3d7330-68b7-546b-b9bb-0e4ee3dccb41", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-jaspi." } }, { "id": "CVE-2022-2047", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:85a66bfe-0f2f-5128-9197-3f6432140b0b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2047 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-jaspi." } }, { "id": "CVE-2022-2191", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:8f5d83d2-6f7c-59ba-8802-4d4ea3924d73", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2191 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-jaspi." } }, { "id": "CVE-2023-26048", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:4ef4f56f-b77c-54b0-b042-7b5c4b30dda7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26048 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-jaspi." } }, { "id": "CVE-2023-26049", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:86f973d6-0197-56ae-a0bb-552c79b99377", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26049 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-jaspi." } }, { "id": "CVE-2023-40167", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:9f6cc635-5ca6-577c-87c6-e4f093c0ca40", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-40167 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-jaspi." } }, { "id": "CVE-2024-13009", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:9979d0ff-aee1-59aa-9127-093a62f5ad0c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-13009 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-jaspi." } }, { "id": "CVE-2024-6763", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:e81bc86d-9e3b-56ea-ae18-0255da3eb18d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-jaspi." } }, { "id": "CVE-2024-7708", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:f73c758a-cb1f-5426-a6bb-de4cd9bbd971", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7708 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-jaspi." } }, { "id": "CVE-2024-8184", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:b26b4973-c5bd-507a-b27b-6cb34c46a60b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-jaspi." } }, { "id": "CVE-2025-11143", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:8b1bd0ed-3714-5381-832a-a364a1c9c286", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-jaspi." } }, { "id": "CVE-2026-10050", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:da49bd1a-fe4d-5e1c-8a79-90e00c27240d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-10050 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-jaspi." } }, { "id": "CVE-2026-10051", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:b40c9227-5292-5b7a-95c2-e72809ac5c38", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10051 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-jaspi." } }, { "id": "CVE-2026-1605", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:d7b0eabf-d140-57d5-89a0-7849b66c8f4d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1605 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-jaspi." } }, { "id": "CVE-2026-18659", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:9eb836ef-faa6-5c00-8d48-2afebf9bccbd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18659 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-jaspi." } }, { "id": "CVE-2026-18660", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:e7364144-d26f-5297-8eb6-d212882737f3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18660 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-jaspi." } }, { "id": "CVE-2026-18662", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:b58d581b-efdf-53ac-8cba-c7a48646cd36", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18662 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-jaspi." } }, { "id": "CVE-2026-19864", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:18712069-125c-516b-9dd1-f3d44a101e12", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-19864 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-jaspi." } }, { "id": "CVE-2026-2332", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:c7080264-127c-5131-a15c-4ebda32ba5f2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-2332 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-jaspi." } }, { "id": "CVE-2026-5795", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:09c119fe-b95c-5760-9e21-8a8889ea2150", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-5795 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-jaspi." } }, { "id": "CVE-2026-6790", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:95bfc38e-b171-53b8-bee9-169a84f50deb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6790 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-jaspi." } }, { "id": "CVE-2026-8384", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-jaspi@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:60ec6b4e-de56-57bf-9fac-95990cf4124c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-8384 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-jaspi." } } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-jaspi@12.0.22-tuxcare.1" } ] }