{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3fe05ccd-2399-57ef-9461-286ec4e95dae", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "jetty-ee9-security", "purl": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-security@12.0.22-tuxcare.1", "type": "library", "group": "org.eclipse.jetty.ee9", "bom-ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-security@12.0.22-tuxcare.1", "version": "12.0.22-tuxcare.1", "pedigree": { "ancestors": [ { "name": "jetty-ee9-security", "purl": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-security@12.0.22", "type": "library", "group": "org.eclipse.jetty.ee9", "version": "12.0.22" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2006-6969", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-security@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:797e1039-cbd2-54d7-a574-58bd207be05e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2006-6969 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-security." } }, { "id": "CVE-2007-1651", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-security@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:c20c545d-f942-5b06-bf45-86f0ac90b4fe", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2007-1651 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-security. Target Jetty 12.0.22 is NOT affected. The CVE concerns a CSRF / session-restoration weakness in Jetty's OpenID Connect support; the two vendor patches (5f2c96dc, 2020 \u2014 move ID-token expiry to initial-auth-only + proper logout/validate delegation; e9f260f4, 2021 \u2014 replace the single anti-forgery CSRF token with a per-session, SecureRandom-keyed csrfMap and mandatory `state` validation) are UPSTREAM Jetty fixes authored by lachlan@webtide.com years before the 12.0.22 release (June 2025). Both fix commits are ancestors of HEAD, and the shipped jetty-core/jetty-openid and jetty-ee9/jetty-ee9-openid modules contain the complete post-fix code. The pre-fix vulnerable pattern (single CSRF_TOKEN setAttribute, isExpired() gating session validity, empty logout()) is absent. Not a TuxCare backport \u2014 the fix is native/upstream, so verdict is not_affected (justification code_not_present), not already_fixed.", "justification": "code_not_present" } }, { "id": "CVE-2007-1652", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-security@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:6c5f4a0c-65b1-5c60-8000-82421b36e8eb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2007-1652 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-security." } }, { "id": "CVE-2011-4461", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-security@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:2c490437-0138-530e-af46-a8ab9488ffb3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-4461 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-security." } }, { "id": "CVE-2015-2080", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-security@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:14d0f1fd-59fe-51dd-a1f2-6b1fc946a2ab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-2080 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-security." } }, { "id": "CVE-2016-4800", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-security@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:bfdc7670-0ab8-5fb9-a7f8-ab4377442882", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-4800 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-security." } }, { "id": "CVE-2017-7656", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-security@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:dadb73a3-b327-503d-aee3-62be44ae4158", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7656 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-security." } }, { "id": "CVE-2017-7657", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-security@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:98104145-ccf3-55c6-a8e5-6f928c1cab38", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7657 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-security." } }, { "id": "CVE-2017-7658", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-security@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:2f98bb4f-6627-5e34-a154-c46496b30504", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7658 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-security." } }, { "id": "CVE-2017-9735", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-security@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:8cc96f8e-6721-5254-ad94-b7f8506e92d8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-9735 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-security." } }, { "id": "CVE-2018-12536", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-security@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:e73c858b-a539-567d-9767-f1eebd58b416", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12536 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-security." } }, { "id": "CVE-2018-12538", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-security@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:ba1c9c76-a52a-5ff1-907f-0e2095cc335e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12538 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-security." } }, { "id": "CVE-2018-12545", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-security@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:8aabe135-7d44-5e07-a7e2-b35757e76a59", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12545 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-security." } }, { "id": "CVE-2019-10241", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-security@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:91a8faca-f1df-578d-84ce-5bfb5be76055", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10241 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-security." } }, { "id": "CVE-2019-10246", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-security@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:c9625187-96e0-5371-ba43-c411790e7ad7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10246 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-security." } }, { "id": "CVE-2019-10247", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-security@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:32f2188c-0379-50d8-9ee3-c98d24054e44", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10247 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-security." } }, { "id": "CVE-2019-17632", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-security@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:31a9f2a9-3dcc-59df-b101-42ad87f78aa6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17632 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-security." } }, { "id": "CVE-2019-17638", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-security@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:8d434aa0-0e83-5b81-8dbd-b3404e1791d5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17638 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-security." } }, { "id": "CVE-2020-27218", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-security@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:311f8e11-c867-5817-8de0-6f835420d786", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27218 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-security." } }, { "id": "CVE-2020-27223", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-security@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:367f87ea-9ac0-559c-9f6c-485e55ab09ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27223 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-security." } }, { "id": "CVE-2021-28165", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-security@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:757b2f64-879a-5115-a989-63292b998ac7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28165 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-security." } }, { "id": "CVE-2021-34428", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-security@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:88630a24-6a66-562d-8539-d493990f2b3e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-security." } }, { "id": "CVE-2022-2047", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-security@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:534ed6ce-89b5-5971-8e1b-0d400984f1ac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2047 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-security." } }, { "id": "CVE-2022-2191", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-security@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:88e00c3d-ab3d-536d-be05-54e926b0e0a0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2191 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-security." } }, { "id": "CVE-2023-26048", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-security@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:dba55d34-4386-5b49-a1c0-3b554a02030e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26048 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-security." } }, { "id": "CVE-2023-26049", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-security@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:aea37d92-0c47-57ed-a2d7-b1f6e09d4414", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26049 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-security." } }, { "id": "CVE-2023-40167", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-security@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:e31334fa-ed29-5c46-ae4a-076b454441fc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-40167 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-security." } }, { "id": "CVE-2024-13009", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-security@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:9ad9c78d-ac94-5221-9fa9-f923450c47d3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-13009 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-security." } }, { "id": "CVE-2024-6763", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-security@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:5de469cc-e506-5fae-8dd5-a9beb0c9e2e7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-security." } }, { "id": "CVE-2024-7708", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-security@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:d82f2d08-14af-50a1-8597-b8b98e07fcd8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7708 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-security." } }, { "id": "CVE-2024-8184", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-security@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:0b981d41-6cdb-5ef4-901c-a1b70581a41d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-security." } }, { "id": "CVE-2025-11143", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-security@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:1618e9c5-d5db-59ca-a9b9-78ef77be5f59", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-security." } }, { "id": "CVE-2026-10050", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-security@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:b6220881-8408-5078-9a6f-0b63ddbe1180", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-10050 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-security." } }, { "id": "CVE-2026-10051", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-security@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:c4943fee-de54-58b3-9beb-30571a1232a8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10051 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-security." } }, { "id": "CVE-2026-1605", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-security@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:038a1834-a8b4-5f4f-b9e1-a63c56a54b0e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1605 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-security." } }, { "id": "CVE-2026-18659", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-security@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:7497f2f9-46b3-5b8a-9677-ca1a0df40eca", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18659 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-security." } }, { "id": "CVE-2026-18660", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-security@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:7f1c826f-1645-5106-941a-772ddd087956", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18660 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-security." } }, { "id": "CVE-2026-18662", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-security@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:71aabfac-4333-58eb-af9d-545315e24b4d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18662 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-security." } }, { "id": "CVE-2026-19864", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-security@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:d6da3b75-c5b0-55ad-b624-9ff825a249f2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-19864 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-security." } }, { "id": "CVE-2026-2332", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-security@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:25d7e65b-fd8c-59d9-bfaf-c83fb4394007", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-2332 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-security." } }, { "id": "CVE-2026-6790", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-security@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:992fb41a-9f1e-525b-9c66-e69bb6b5a8d5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-6790 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-security." } }, { "id": "CVE-2026-8384", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-security@12.0.22-tuxcare.1" } ], "bom-ref": "urn:uuid:0b710370-71e3-5a68-bcc3-91d5891424cb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-8384 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee9:jetty-ee9-security." } } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.ee9/jetty-ee9-security@12.0.22-tuxcare.1" } ] }