{
  "@id": "urn:uuid:8b3eb21b-1251-4954-afe0-4cc3e0e4b9fd",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 33,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T14:48:00.154664+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-jasper@8.5.100-tuxcare.10",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-jasper@8.5.100-tuxcare.10"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2016-5018 does not affect version 8.5.100-tuxcare.10 of org.apache.tomcat:tomcat-jasper. CVE-2016-5018 affects Apache Tomcat 8.5.0-8.5.4",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5018"
      },
      "impact_statement": "CVE-2016-5018 affects Apache Tomcat 8.5.0-8.5.4"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-jasper@8.5.100-tuxcare.10",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-jasper@8.5.100-tuxcare.10"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-45143 does not affect version 8.5.100-tuxcare.10 of org.apache.tomcat:tomcat-jasper. Target Tomcat 8.5.100 is not affected by CVE-2022-45143. The vulnerability (unescaped JSON values in JsonErrorReportValve allowing output manipulation) was fixed by upstream Apache commit 0cab3a56bd (Mark Thomas, Nov 2022), which was already included in the Apache Tomcat 8.5.100 release (tagged Mar 2024). The fix adds JSONFilter.escape() calls to sanitize type, message, and description values before embedding them in JSON output. No TuxCare-specific backport was required for 8.5.100 as the fix came from upstream.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-45143"
      },
      "impact_statement": "Target Tomcat 8.5.100 is not affected by CVE-2022-45143. The vulnerability (unescaped JSON values in JsonErrorReportValve allowing output manipulation) was fixed by upstream Apache commit 0cab3a56bd (Mark Thomas, Nov 2022), which was already included in the Apache Tomcat 8.5.100 release (tagged Mar 2024). The fix adds JSONFilter.escape() calls to sanitize type, message, and description values before embedding them in JSON output. No TuxCare-specific backport was required for 8.5.100 as the fix came from upstream."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-jasper@8.5.100-tuxcare.10",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-jasper@8.5.100-tuxcare.10"
          }
        }
      ],
      "timestamp": "2026-10-28T18:21:18.934330+00:00",
      "status_notes": "Vulnerability CVE-2023-42795 does not affect version 8.5.100-tuxcare.10 of org.apache.tomcat:tomcat-jasper. not_affected \u2014 Target Apache Tomcat 8.5.100 is NOT AFFECTED by CVE-2023-42795. The vulnerability affects versions 8.5.0 through 8.5.93 due to incomplete object recycling when exceptions occur during cleanup, potentially causing information leakage between requests. The fix was committed upstream by Mark Thomas (markt@apache.org) on 2023-10-05 in commit 30f8063d7a and shipped in version 8.5.94. Since the targe...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-42795"
      },
      "impact_statement": "not_affected \u2014 Target Apache Tomcat 8.5.100 is NOT AFFECTED by CVE-2023-42795. The vulnerability affects versions 8.5.0 through 8.5.93 due to incomplete object recycling when exceptions occur during cleanup, potentially causing information leakage between requests. The fix was committed upstream by Mark Thomas (markt@apache.org) on 2023-10-05 in commit 30f8063d7a and shipped in version 8.5.94. Since the targe..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.apache.tomcat/tomcat-jasper@8.5.100-tuxcare.10",
          "identifiers": {
            "purl": "pkg:maven/org.apache.tomcat/tomcat-jasper@8.5.100-tuxcare.10"
          }
        }
      ],
      "timestamp": "2026-10-28T21:58:36.804623+00:00",
      "status_notes": "Vulnerability CVE-2026-53434 affects version 8.5.100-tuxcare.10 of org.apache.tomcat:tomcat-jasper.",
      "vulnerability": {
        "name": "CVE-2026-53434"
      },
      "action_statement": "Vulnerability CVE-2026-53434 affects version 8.5.100-tuxcare.10 of org.apache.tomcat:tomcat-jasper."
    }
  ]
}