{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8c41f820-3297-5188-bc4e-90535e0df92d", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "jetty-ee9-openid", "purl": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-openid@12.0.22-tuxcare.1", "type": "library", "group": "org.eclipse.jetty.ee9", "bom-ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-openid@12.0.22-tuxcare.1", "version": "12.0.22-tuxcare.1", "pedigree": { "ancestors": [ { "name": "jetty-ee9-openid", "purl": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-openid@12.0.22", "type": "library", "group": "org.eclipse.jetty.ee9", "version": "12.0.22" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2006-6969", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:65c30eba-73c6-5d84-bfed-66cf6be092a5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2006-6969 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-openid." } }, { "id": "CVE-2007-1651", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:d8e73b2f-3113-555b-8bd0-1361051b1b1f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2007-1651 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-openid. Target Jetty 12.0.22 is NOT affected. The CVE concerns a CSRF / session-restoration weakness in Jetty's OpenID Connect support; the two vendor patches (5f2c96dc, 2020 \u2014 move ID-token expiry to initial-auth-only + proper logout/validate delegation; e9f260f4, 2021 \u2014 replace the single anti-forgery CSRF token with a per-session, SecureRandom-keyed csrfMap and mandatory `state` validation) are UPSTREAM Jetty fixes authored by lachlan@webtide.com years before the 12.0.22 release (June 2025). Both fix commits are ancestors of HEAD, and the shipped jetty-core/jetty-openid and jetty-ee9/jetty-ee9-openid modules contain the complete post-fix code. The pre-fix vulnerable pattern (single CSRF_TOKEN setAttribute, isExpired() gating session validity, empty logout()) is absent. Not a TuxCare backport \u2014 the fix is native/upstream, so verdict is not_affected (justification code_not_present), not already_fixed.", "justification": "code_not_present" } }, { "id": "CVE-2007-1652", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:8738a218-dc6c-575a-9836-8081e1f7cc99", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2007-1652 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-openid." } }, { "id": "CVE-2011-4461", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:aafee115-0f07-53a3-8ca6-23cf81e886fe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-4461 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-openid." } }, { "id": "CVE-2015-2080", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:8719378e-bcff-5d0c-89f4-13dbaad90842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-2080 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-openid." } }, { "id": "CVE-2016-4800", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:aace093a-d654-5b64-a45a-3542c0357659", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-4800 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-openid." } }, { "id": "CVE-2017-7656", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:0ea3198b-4d9d-5fe6-b556-b93f4065e5b9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7656 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-openid." } }, { "id": "CVE-2017-7657", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:e006ba52-8e92-5c9d-8833-cc4f1d73dec0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7657 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-openid." } }, { "id": "CVE-2017-7658", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:1f7cfc1b-47f3-5895-8fc1-80e67dee7675", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7658 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-openid." } }, { "id": "CVE-2017-9735", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:13709ebd-6c85-53c2-89ac-31270551b7f3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-9735 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-openid." } }, { "id": "CVE-2018-12536", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:ae539520-60f9-5492-9c88-c48075de56d1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12536 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-openid." } }, { "id": "CVE-2018-12538", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:0b9dfb58-3e6f-5e2b-a1a1-08f59861d913", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12538 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-openid." } }, { "id": "CVE-2018-12545", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:e255dc89-2b94-52fa-a257-0465e3111302", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12545 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-openid." } }, { "id": "CVE-2019-10241", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:e10c9329-7924-5bdb-85e9-0b295dca1184", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10241 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-openid." } }, { "id": "CVE-2019-10246", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:3bb9ed8a-b217-5c5c-a46d-6d9b2a974a79", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10246 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-openid." } }, { "id": "CVE-2019-10247", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:fce9641f-1bf7-5c19-96cf-ace7fd4467eb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10247 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-openid." } }, { "id": "CVE-2019-17632", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:4b340152-fba6-5c86-936b-19153908a6f6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17632 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-openid." } }, { "id": "CVE-2019-17638", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:b83a002d-2de2-5aad-8f9f-64d7f2dea175", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17638 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-openid." } }, { "id": "CVE-2020-27218", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:4230b517-a414-5460-88d7-755a396e5202", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27218 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-openid." } }, { "id": "CVE-2020-27223", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:3f735d25-1c8a-505a-86a1-1fb6cc48502d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27223 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-openid." } }, { "id": "CVE-2021-28165", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:4b83c54a-d06c-5f1b-ad9f-4c2aa997974d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28165 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-openid." } }, { "id": "CVE-2021-34428", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:a985f2c5-41f9-5ea8-93f7-aa52c7cf3a43", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-openid." } }, { "id": "CVE-2022-2047", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:eccb2796-6fdf-5939-bc92-44bbce43e7ca", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2047 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-openid." } }, { "id": "CVE-2022-2191", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:821d70fb-0d55-530a-9d5e-6ece45e7a82e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2191 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-openid." } }, { "id": "CVE-2023-26048", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:9f6f3ca0-1d87-5137-91f6-2abac84c4d32", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26048 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-openid." } }, { "id": "CVE-2023-26049", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:52eee4b0-a8be-5ac9-a8f4-770e959267f1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26049 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-openid." } }, { "id": "CVE-2023-40167", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:84bbc308-dcd0-5c6d-a46e-88c3a4a7d91c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-40167 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-openid." } }, { "id": "CVE-2023-41900", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:7c842015-68f9-5e98-aebe-77e05e292992", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-41900 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-openid." } }, { "id": "CVE-2024-13009", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:dc798a75-c51a-5b91-a564-341a19816a4a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-13009 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-openid." } }, { "id": "CVE-2024-6763", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:fd271cd0-9d3a-58e0-8a8c-307c2ac37ef3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-openid." } }, { "id": "CVE-2024-7708", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:982d6a57-7c84-5e2e-bec1-4319a5a3edba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7708 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-openid." } }, { "id": "CVE-2024-8184", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:7f46ae8d-cc52-5fe3-9c17-93e72f8b51f5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-openid." } }, { "id": "CVE-2025-11143", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:ff8ec3e4-0742-5a32-851c-bc1a079e6d92", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-openid." } }, { "id": "CVE-2026-10050", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:fdfde251-623f-57e5-91e5-db49fc40a391", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-10050 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-openid." } }, { "id": "CVE-2026-10051", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:c1134f28-3495-5cfd-a854-1d333b16480f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10051 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-openid." } }, { "id": "CVE-2026-1605", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:b6e076f1-ba04-5bbd-a19a-73c9acb3e9c5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1605 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-openid." } }, { "id": "CVE-2026-18659", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:5f6442be-9b91-515c-8d5f-c96fe6707e12", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18659 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-openid." } }, { "id": "CVE-2026-18660", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:57303218-d489-5ec2-a251-4459c0abc23e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18660 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-openid." } }, { "id": "CVE-2026-18662", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:4e39b854-308e-5e37-99d7-5b0e9be8f80f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18662 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-openid." } }, { "id": "CVE-2026-19864", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:951afe80-11bb-5651-8d10-22e6a3db788c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-19864 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-openid." } }, { "id": "CVE-2026-2332", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:be12c99a-f17c-5249-b933-fc00948125d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-2332 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-openid." } }, { "id": "CVE-2026-6790", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:1d9c31d6-e18e-58f9-b08b-c92449899303", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6790 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-openid." } }, { "id": "CVE-2026-8384", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-openid@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:8f9fb0f0-c208-5ead-ab68-a99a7965e6b4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-8384 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-openid." } } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-openid@12.0.22-tuxcare.1" } ] }