{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:4017b635-9568-5ea1-a661-8db673a009dd", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "jetty-gcloud-session-manager", "purl": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@9.4.58.v20250814-tuxcare.7", "type": "library", "group": "org.eclipse.jetty.gcloud", "bom-ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@9.4.58.v20250814-tuxcare.7", "version": "9.4.58.v20250814-tuxcare.7", "pedigree": { "ancestors": [ { "name": "jetty-gcloud-session-manager", "purl": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@9.4.58.v20250814", "type": "library", "group": "org.eclipse.jetty.gcloud", "version": "9.4.58.v20250814" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2006-6969", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:fd5f8d3a-49b6-53b2-8b91-063d0d83b8f6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2006-6969 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2011-4461", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:41e1fc2a-119f-5bc1-8446-7b9efa87d5b7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-4461 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2015-2080", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:4d3c6af1-b11f-545d-a0f5-a12a2a423c72", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-2080 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2016-4800", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:f75b7c09-c1f0-53d4-aad6-b7453da2adbe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-4800 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2017-7656", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:2b51599d-2236-54b6-9006-761b004e7ce2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7656 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2017-7657", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:3f32ba59-c201-5137-a3b7-2677f6900767", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7657 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2017-7658", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:dc3a3d69-5412-5355-aa27-ff64c4f3ffd7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7658 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2017-9735", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:664503b2-6cd0-5b52-836f-0f4db2e9e566", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-9735 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2018-12536", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:a2ae8688-dddb-5cb7-adc8-ad91dfcefd48", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12536 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2018-12538", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:804e5163-5ea4-5a45-960f-58dec5ba4c8c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12538 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2018-12545", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:950765ba-a67a-551b-b77e-333eb40b1178", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12545 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2019-10241", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:5c60c224-b6b5-5298-afed-d0bc8e4cf7d1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10241 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2019-10246", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:f7f87f71-ba3c-5152-a9bc-b675e3782392", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10246 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2019-10247", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:bea8520a-e5d7-5d96-b0c4-ddd3d68e8438", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10247 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2019-17632", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:2cc3549c-f525-5d9f-9a0a-e1bc5277e556", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17632 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2019-17638", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:7907c034-ffdf-5f43-9f15-2d748b2bf115", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17638 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2020-27218", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:6b5d05f1-949d-5e7b-b43a-94e748f80ddd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27218 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2020-27223", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:17995d3d-b08d-5710-8a3d-85b7c5c5f080", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27223 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2021-28165", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:7d83b399-65d8-5024-aa6f-832fd375a24a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28165 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2021-34428", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:106de379-9566-568a-941d-ab0bfcc8cc59", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2022-2047", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:8ac793be-86df-5f56-85f2-883601ab5dda", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2047 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2022-2191", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:698b31e7-ccc7-5033-b025-2038168a8ca9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2191 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2023-26048", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:0644daee-65d0-5931-9204-a07c0e2e1ca9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26048 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2023-26049", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:05633dbf-0ea2-5273-a72c-27a19e3b938e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26049 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2023-40167", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:ce9ff9b7-c4b7-571f-8262-412b7a4a9a88", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-40167 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2024-13009", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:039600a3-e266-507e-9697-56d5e5188d0b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-13009 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2024-6763", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:82cf8026-0b3c-575e-992a-4c17f3ac65e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2024-7708", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:d014f4ce-56c1-5685-aba4-f31dbe67dd94", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7708 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2024-8184", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:0aa21092-730b-5154-82dd-0bb9b67e76a7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2025-11143", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:d15165a2-6bd3-5d1a-babb-a3498695ec0f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2026-10051", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:880bc98e-3a39-5a50-9b9b-4a5d413aa0c6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10051 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2026-1605", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:b39b0ead-8455-55d7-842c-29710d74e8fd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-1605 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2026-2332", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:0bba78e7-e3b4-5783-9ddf-a43745779284", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2026-6790", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:4be2ef6f-6a51-562d-a49f-a1434bcf70bc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager." } }, { "id": "CVE-2026-8384", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@9.4.58.v20250814-tuxcare.7" } ], "bom-ref": "urn:uuid:b943e9f7-b2f7-5780-9f09-16c1be5d8266", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 9.4.58.v20250814-tuxcare.7 of org.eclipse.jetty.gcloud:jetty-gcloud-session-manager. not_affected \u2014 Jetty 9.4.58.v20250814 is not affected by CVE-2026-8384. The vulnerability exists only in Jetty 12's refactored canonicalPath() implementation that combines path decoding and canonicalization with slash-state tracking. Jetty 9.4 uses a two-stage architecture (decodePath() followed by canonicalPath()) that correctly normalizes paths containing semicolon path parameters before dot-dot segments, p...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.gcloud/jetty-gcloud-session-manager@9.4.58.v20250814-tuxcare.7" } ] }