{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a1661e3f-d497-55ca-8e30-dc80575629a0", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "jetty-ee9-quickstart", "purl": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-quickstart@12.0.22-tuxcare.1", "type": "library", "group": "org.eclipse.jetty.ee9", "bom-ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-quickstart@12.0.22-tuxcare.1", "version": "12.0.22-tuxcare.1", "pedigree": { "ancestors": [ { "name": "jetty-ee9-quickstart", "purl": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-quickstart@12.0.22", "type": "library", "group": "org.eclipse.jetty.ee9", "version": "12.0.22" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2006-6969", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-quickstart@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:afc6c093-98a1-539e-b91b-361999ccbf9f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2006-6969 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-quickstart." } }, { "id": "CVE-2007-1651", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-quickstart@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:317eaf21-21b6-514c-8071-1f5858645ad6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2007-1651 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-quickstart. Target Jetty 12.0.22 is NOT affected. The CVE concerns a CSRF / session-restoration weakness in Jetty's OpenID Connect support; the two vendor patches (5f2c96dc, 2020 \u2014 move ID-token expiry to initial-auth-only + proper logout/validate delegation; e9f260f4, 2021 \u2014 replace the single anti-forgery CSRF token with a per-session, SecureRandom-keyed csrfMap and mandatory `state` validation) are UPSTREAM Jetty fixes authored by lachlan@webtide.com years before the 12.0.22 release (June 2025). Both fix commits are ancestors of HEAD, and the shipped jetty-core/jetty-openid and jetty-ee9/jetty-ee9-openid modules contain the complete post-fix code. The pre-fix vulnerable pattern (single CSRF_TOKEN setAttribute, isExpired() gating session validity, empty logout()) is absent. Not a TuxCare backport \u2014 the fix is native/upstream, so verdict is not_affected (justification code_not_present), not already_fixed.", "justification": "code_not_present" } }, { "id": "CVE-2007-1652", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-quickstart@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:0c58c52c-c46d-506d-a6e0-c488a081ddf4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2007-1652 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-quickstart." } }, { "id": "CVE-2011-4461", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-quickstart@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:778c6257-577b-5a66-9eb0-674b9e70bf85", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-4461 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-quickstart." } }, { "id": "CVE-2015-2080", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-quickstart@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:2113f2ae-ca14-5ca7-9b76-4cb45c39ed23", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-2080 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-quickstart." } }, { "id": "CVE-2016-4800", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-quickstart@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:87958e37-7a0d-52bd-b3aa-2bc793628854", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-4800 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-quickstart." } }, { "id": "CVE-2017-7656", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-quickstart@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:85a6660f-3919-5e09-887d-290464be6298", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7656 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-quickstart." } }, { "id": "CVE-2017-7657", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-quickstart@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:bd5f5075-29db-554c-bf26-652e49a042b8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7657 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-quickstart." } }, { "id": "CVE-2017-7658", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-quickstart@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:4e9dbce0-38f6-5a71-bce5-fc212b47e1b6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7658 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-quickstart." } }, { "id": "CVE-2017-9735", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-quickstart@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:d54de671-96aa-5eb3-8326-72f780a9f94d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-9735 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-quickstart." } }, { "id": "CVE-2018-12536", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-quickstart@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:f42ab768-6fe7-5256-b06e-998e713d3a1f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12536 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-quickstart." } }, { "id": "CVE-2018-12538", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-quickstart@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:90b5bdfa-f8cd-589d-8159-ce457355b22c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12538 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-quickstart." } }, { "id": "CVE-2018-12545", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-quickstart@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:bb68c94d-94b7-55b2-a775-262ee68d7e93", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12545 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-quickstart." } }, { "id": "CVE-2019-10241", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-quickstart@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:2e231b74-8fa8-5eca-88c1-20a555465f58", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10241 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-quickstart." } }, { "id": "CVE-2019-10246", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-quickstart@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:c1f58489-f2f0-540f-9689-663f5ffaafb0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10246 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-quickstart." } }, { "id": "CVE-2019-10247", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-quickstart@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:c49d6641-f772-5838-a304-99d1255522da", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10247 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-quickstart." } }, { "id": "CVE-2019-17632", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-quickstart@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:c4857a17-fbce-5727-83f6-d0bcb1db9de2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17632 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-quickstart." } }, { "id": "CVE-2019-17638", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-quickstart@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:193137ec-8175-5263-a85c-8d7d73c929e8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17638 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-quickstart." } }, { "id": "CVE-2020-27218", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-quickstart@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:c378d834-89ef-5210-9cbc-0481a9e40ba0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27218 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-quickstart." } }, { "id": "CVE-2020-27223", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-quickstart@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:b34b0143-6502-5a80-b0be-dbdcab6cc31b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27223 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-quickstart." } }, { "id": "CVE-2021-28165", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-quickstart@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:d4bf3ff6-ee67-581c-bca3-beb18cbd1185", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28165 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-quickstart." } }, { "id": "CVE-2021-34428", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-quickstart@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:1fed7993-418d-529e-b0c8-e24d9359489e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-quickstart." } }, { "id": "CVE-2022-2047", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-quickstart@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:4d3ce0a2-d46b-5cf3-a3de-24f0a28e54b6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2047 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-quickstart." } }, { "id": "CVE-2022-2191", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-quickstart@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:b2b0e994-6b9f-5157-84e2-ad0938a9a750", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2191 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-quickstart." } }, { "id": "CVE-2023-26048", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-quickstart@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:b7a51661-aef7-5816-84fc-42d4a6eab50c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26048 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-quickstart." } }, { "id": "CVE-2023-26049", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-quickstart@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:cdb3b20f-a5f2-5562-a089-42a853261476", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26049 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-quickstart." } }, { "id": "CVE-2023-40167", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-quickstart@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:627971ce-278d-59e9-af93-5e512969201b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-40167 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-quickstart." } }, { "id": "CVE-2024-13009", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-quickstart@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:1969bf0f-a914-50e0-af73-730a48198365", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-13009 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-quickstart." } }, { "id": "CVE-2024-6763", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-quickstart@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:5481c493-968e-5e28-9615-3eac52cc54d2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-quickstart." } }, { "id": "CVE-2024-7708", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-quickstart@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:8d28a3f4-3ffe-5456-b223-50d0023c4b39", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7708 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-quickstart." } }, { "id": "CVE-2024-8184", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-quickstart@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:a1795cd6-8646-56c8-9427-7e13ce889bb2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-quickstart." } }, { "id": "CVE-2025-11143", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-quickstart@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:7aad43ee-c82c-5134-a95c-2b0e40dc652e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-quickstart." } }, { "id": "CVE-2026-10050", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-quickstart@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:6d649639-d888-5513-a58f-cc3eca522b90", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-10050 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-quickstart." } }, { "id": "CVE-2026-10051", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-quickstart@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:17824c97-37a9-5859-a573-ca0cbdf975a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10051 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-quickstart." } }, { "id": "CVE-2026-1605", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-quickstart@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:d9523365-1cac-508e-bc63-7466ce594712", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1605 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-quickstart." } }, { "id": "CVE-2026-18659", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-quickstart@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:a73054f7-8a9d-5083-ae7b-d440d8af3313", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18659 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-quickstart." } }, { "id": "CVE-2026-18660", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-quickstart@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:1a9269d4-3936-537a-8e1f-4f637a2cf325", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18660 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-quickstart." } }, { "id": "CVE-2026-18661", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-quickstart@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:81c4028d-7db6-53d5-936b-248904def75d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18661 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-quickstart." } }, { "id": "CVE-2026-18662", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-quickstart@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:d02a2b5b-544f-581f-bade-2efdae5058db", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18662 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-quickstart." } }, { "id": "CVE-2026-19864", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-quickstart@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:4f085f27-4191-5cf3-a643-8c5177e37034", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-19864 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-quickstart." } }, { "id": "CVE-2026-2332", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-quickstart@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:322a845c-5664-59e2-9259-414ebcae0b2c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-2332 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-quickstart." } }, { "id": "CVE-2026-6790", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-quickstart@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:87845545-4d34-5cdf-942c-77561f540154", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6790 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-quickstart." } }, { "id": "CVE-2026-8384", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-quickstart@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:7498203b-96ea-526b-bf04-2eb778f9c5be", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-8384 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-quickstart." } }, { "id": "GHSA-58qw-p7qm-5rvh", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-quickstart@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:9738696d-2da4-5ced-9bea-d8b2371f8381", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-quickstart." } } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-quickstart@12.0.22-tuxcare.1" } ] }