{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:982d4864-fb4a-5a4a-af8a-ec177bbab47f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "jetty-ee9-nested", "purl": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-nested@12.0.22-tuxcare.1", "type": "library", "group": "org.eclipse.jetty.ee9", "bom-ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-nested@12.0.22-tuxcare.1", "version": "12.0.22-tuxcare.1", "pedigree": { "ancestors": [ { "name": "jetty-ee9-nested", "purl": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-nested@12.0.22", "type": "library", "group": "org.eclipse.jetty.ee9", "version": "12.0.22" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2006-6969", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-nested@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:f0420ca2-1782-5640-907e-d36ff00ae28d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2006-6969 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-nested." } }, { "id": "CVE-2007-1651", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-nested@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:e8d70c03-0670-55b4-9722-3db4992ff6c1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2007-1651 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-nested. Target Jetty 12.0.22 is NOT affected. The CVE concerns a CSRF / session-restoration weakness in Jetty's OpenID Connect support; the two vendor patches (5f2c96dc, 2020 \u2014 move ID-token expiry to initial-auth-only + proper logout/validate delegation; e9f260f4, 2021 \u2014 replace the single anti-forgery CSRF token with a per-session, SecureRandom-keyed csrfMap and mandatory `state` validation) are UPSTREAM Jetty fixes authored by lachlan@webtide.com years before the 12.0.22 release (June 2025). Both fix commits are ancestors of HEAD, and the shipped jetty-core/jetty-openid and jetty-ee9/jetty-ee9-openid modules contain the complete post-fix code. The pre-fix vulnerable pattern (single CSRF_TOKEN setAttribute, isExpired() gating session validity, empty logout()) is absent. Not a TuxCare backport \u2014 the fix is native/upstream, so verdict is not_affected (justification code_not_present), not already_fixed.", "justification": "code_not_present" } }, { "id": "CVE-2007-1652", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-nested@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:42fd0f92-b344-5b34-b524-73fc40531751", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2007-1652 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-nested." } }, { "id": "CVE-2011-4461", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-nested@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:9fa0227a-4209-511e-b04c-c88f6e7f6bb5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-4461 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-nested." } }, { "id": "CVE-2015-2080", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-nested@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:86e65d76-ab52-5099-aebe-4122c0d3f5d3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-2080 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-nested." } }, { "id": "CVE-2016-4800", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-nested@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:bb58a9fb-c27b-5267-bc33-23017e0d640e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-4800 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-nested." } }, { "id": "CVE-2017-7656", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-nested@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:1d0a5f73-9588-586c-bb70-4d9b25afce4d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7656 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-nested." } }, { "id": "CVE-2017-7657", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-nested@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:59ad6cca-4a7a-5903-8671-d697de2545a4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7657 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-nested." } }, { "id": "CVE-2017-7658", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-nested@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:6a7af72e-93fb-516f-b536-c026d4bfa481", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7658 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-nested." } }, { "id": "CVE-2017-9735", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-nested@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:f11b139b-dd81-5ae3-9d2c-b9da21688ac9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-9735 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-nested." } }, { "id": "CVE-2018-12536", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-nested@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:125467e5-9c33-5fe3-af8d-b5d35eda8eea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12536 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-nested." } }, { "id": "CVE-2018-12538", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-nested@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:c592c654-1eaa-5f2d-b64a-14f936d99482", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12538 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-nested." } }, { "id": "CVE-2018-12545", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-nested@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:c71181db-7419-5b21-8a36-1f1482c532bd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12545 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-nested." } }, { "id": "CVE-2019-10241", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-nested@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:32fd2515-25a2-5f32-9815-faa27e656c4f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10241 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-nested." } }, { "id": "CVE-2019-10246", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-nested@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:e774b03c-028d-5952-848c-f193ab5aaf07", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10246 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-nested." } }, { "id": "CVE-2019-10247", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-nested@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:51f214e5-2855-5f11-bc2a-586de2be62f9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10247 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-nested." } }, { "id": "CVE-2019-17632", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-nested@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:27801c3f-37ae-5615-b0c2-a3dded7939b8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17632 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-nested." } }, { "id": "CVE-2019-17638", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-nested@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:2147e614-0d74-53b6-a12d-5fdfb32fe915", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17638 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-nested." } }, { "id": "CVE-2020-27218", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-nested@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:cfd434d8-c11f-5310-987d-0c43e5cc7326", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27218 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-nested." } }, { "id": "CVE-2020-27223", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-nested@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:ff150cd3-6374-52c0-9b0a-ec0dbdc9a092", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27223 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-nested." } }, { "id": "CVE-2021-28165", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-nested@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:bc84f2b5-f0e0-5e3f-91f3-3dc392d49e40", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28165 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-nested." } }, { "id": "CVE-2021-34428", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-nested@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:692ff2cb-27ab-53c9-82a6-0076d2777114", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-nested." } }, { "id": "CVE-2022-2047", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-nested@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:9d4628bc-5171-5025-900f-a852f6947457", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2047 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-nested." } }, { "id": "CVE-2022-2191", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-nested@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:a17e512d-e3ea-5fa7-83fe-259f6bef80d7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2191 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-nested." } }, { "id": "CVE-2023-26048", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-nested@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:a127db6a-7120-5981-996a-177fcfc6bb27", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26048 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-nested." } }, { "id": "CVE-2023-26049", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-nested@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:b69d2cd8-4777-5c1c-8f0c-1570bc8ffe52", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26049 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-nested." } }, { "id": "CVE-2023-40167", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-nested@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:f8f7b605-5c7f-5200-b180-b438d94e25d2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-40167 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-nested." } }, { "id": "CVE-2024-13009", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-nested@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:25ca50e3-881b-56ea-9ae3-7d03460cce06", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-13009 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-nested." } }, { "id": "CVE-2024-6763", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-nested@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:5de1d353-f17e-5fe4-aa0a-5c6bd97d38ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-nested." } }, { "id": "CVE-2024-7708", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-nested@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:577325a6-e039-5066-9cd5-d514c54729be", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7708 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-nested." } }, { "id": "CVE-2024-8184", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-nested@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:11f8b4aa-58fb-5537-9160-328f4ef37143", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-nested." } }, { "id": "CVE-2025-11143", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-nested@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:fb4cd125-48be-5290-94ba-eb4242af023f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-nested." } }, { "id": "CVE-2026-10050", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-nested@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:605e511e-9104-5098-86bc-da49e2ec6971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-10050 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-nested." } }, { "id": "CVE-2026-10051", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-nested@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:f8e263f0-c59e-56c1-96f0-e0d6f3586c43", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10051 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-nested." } }, { "id": "CVE-2026-1605", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-nested@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:75194f88-04ce-5001-b951-db5acfed4906", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1605 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-nested." } }, { "id": "CVE-2026-18660", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-nested@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:d155f5b6-2368-55bc-ad5f-e771d92b3a29", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18660 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-nested." } }, { "id": "CVE-2026-19864", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-nested@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:01f2301a-8acd-5ca6-ad02-7b626723dca6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-19864 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-nested." } }, { "id": "CVE-2026-2332", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-nested@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:d135715d-e755-5076-ad05-402d97ef958c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-2332 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-nested." } }, { "id": "CVE-2026-6790", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-nested@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:ef6c67ff-0cc8-55d9-80ae-267425a69206", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6790 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-nested." } }, { "id": "CVE-2026-8384", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-nested@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:f59d4aa8-0ddb-555e-98ff-eea639105c02", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-8384 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-nested." } } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-nested@12.0.22-tuxcare.1" } ] }