{
  "@id": "urn:uuid:f46e3cca-362e-4266-9a23-d8ad4f585e08",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 18,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-31T15:50:00.104086+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-common@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-common@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T20:16:57.791784+00:00",
      "status_notes": "Vulnerability CVE-2007-1651 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-common. Target Jetty 12.0.22 is NOT affected. The CVE concerns a CSRF / session-restoration weakness in Jetty's OpenID Connect support; the two vendor patches (5f2c96dc, 2020 \u2014 move ID-token expiry to initial-auth-only + proper logout/validate delegation; e9f260f4, 2021 \u2014 replace the single anti-forgery CSRF token with a per-session, SecureRandom-keyed csrfMap and mandatory `state` validation) are UPSTREAM Jetty fixes authored by lachlan@webtide.com years before the 12.0.22 release (June 2025). Both fix commits are ancestors of HEAD, and the shipped jetty-core/jetty-openid and jetty-ee9/jetty-ee9-openid modules contain the complete post-fix code. The pre-fix vulnerable pattern (single CSRF_TOKEN setAttribute, isExpired() gating session validity, empty logout()) is absent. Not a TuxCare backport \u2014 the fix is native/upstream, so verdict is not_affected (justification code_not_present), not already_fixed.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2007-1651"
      },
      "impact_statement": "Target Jetty 12.0.22 is NOT affected. The CVE concerns a CSRF / session-restoration weakness in Jetty's OpenID Connect support; the two vendor patches (5f2c96dc, 2020 \u2014 move ID-token expiry to initial-auth-only + proper logout/validate delegation; e9f260f4, 2021 \u2014 replace the single anti-forgery CSRF token with a per-session, SecureRandom-keyed csrfMap and mandatory `state` validation) are UPSTREAM Jetty fixes authored by lachlan@webtide.com years before the 12.0.22 release (June 2025). Both fix commits are ancestors of HEAD, and the shipped jetty-core/jetty-openid and jetty-ee9/jetty-ee9-openid modules contain the complete post-fix code. The pre-fix vulnerable pattern (single CSRF_TOKEN setAttribute, isExpired() gating session validity, empty logout()) is absent. Not a TuxCare backport \u2014 the fix is native/upstream, so verdict is not_affected (justification code_not_present), not already_fixed."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-common@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-common@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T20:16:57.791784+00:00",
      "status_notes": "Vulnerability CVE-2007-1652 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-common.",
      "vulnerability": {
        "name": "CVE-2007-1652"
      },
      "action_statement": "Vulnerability CVE-2007-1652 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-common."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-common@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-common@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T14:47:00.095922+00:00",
      "status_notes": "Vulnerability CVE-2022-2047 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-common. not_affected \u2014 CVE-2022-2047 affects Jetty's HttpURI class parsing of malformed URIs like `http://localhost;/path`. The target is Jetty 12.0.22-tuxcare.1, a major version released after the vulnerability was fixed. The fix (isPathValidForAuthority validation) was already present in upstream Jetty 12.0.0 (released 2023-08-07), over a year after the CVE was patched in Jetty 9/10/11 (2022-05-26). The vulnerable ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-2047"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-2047 affects Jetty's HttpURI class parsing of malformed URIs like `http://localhost;/path`. The target is Jetty 12.0.22-tuxcare.1, a major version released after the vulnerability was fixed. The fix (isPathValidForAuthority validation) was already present in upstream Jetty 12.0.0 (released 2023-08-07), over a year after the CVE was patched in Jetty 9/10/11 (2022-05-26). The vulnerable ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-common@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-common@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T15:50:00.104086+00:00",
      "status_notes": "Vulnerability CVE-2023-40167 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-common. not_affected \u2014 CVE-2023-40167 is NOT AFFECTED in Jetty 12.0.22. The vulnerability (accepting '+' prefix in Content-Length header values, leading to potential HTTP request smuggling) was fixed in the upstream Jetty codebase on 2023-08-18 by Greg Wilkins in commit 003e46cae4d7. This fix replaced Long.parseLong() with character-by-character validation that strictly enforces RFC 9110 Section 8.6 (only '0'-'9' dig...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-40167"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-40167 is NOT AFFECTED in Jetty 12.0.22. The vulnerability (accepting '+' prefix in Content-Length header values, leading to potential HTTP request smuggling) was fixed in the upstream Jetty codebase on 2023-08-18 by Greg Wilkins in commit 003e46cae4d7. This fix replaced Long.parseLong() with character-by-character validation that strictly enforces RFC 9110 Section 8.6 (only '0'-'9' dig..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-common@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-common@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T15:27:00.073475+00:00",
      "status_notes": "Vulnerability CVE-2024-6763 does not affect version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-common. not_affected \u2014 CVE-2024-6763 fix is already present in jetty 12.0.22. The upstream commit c880d9309b6 (authored by gregw@webtide.com) added comprehensive authority validation to HttpURI, including checks that reject malformed URIs with invalid characters in the authority section. This commit shipped in the upstream Jetty 12.0.22 release before TuxCare onboarded it (first TuxCare commit: 11545e1f96a). The vali...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-6763"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-6763 fix is already present in jetty 12.0.22. The upstream commit c880d9309b6 (authored by gregw@webtide.com) added comprehensive authority validation to HttpURI, including checks that reject malformed URIs with invalid characters in the authority section. This commit shipped in the upstream Jetty 12.0.22 release before TuxCare onboarded it (first TuxCare commit: 11545e1f96a). The vali..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-common@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-common@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T20:16:57.791784+00:00",
      "status_notes": "Vulnerability CVE-2025-11143 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-common.",
      "vulnerability": {
        "name": "CVE-2025-11143"
      },
      "action_statement": "Vulnerability CVE-2025-11143 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-common."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-common@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-common@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T20:18:00.127363+00:00",
      "status_notes": "Vulnerability CVE-2026-2332 is fixed in version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-common.",
      "vulnerability": {
        "name": "CVE-2026-2332"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-common@12.0.22-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty.ee8.websocket/jetty-ee8-websocket-jetty-common@12.0.22-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T20:16:57.791784+00:00",
      "status_notes": "Vulnerability CVE-2026-8384 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-common.",
      "vulnerability": {
        "name": "CVE-2026-8384"
      },
      "action_statement": "Vulnerability CVE-2026-8384 affects version 12.0.22-tuxcare.1 of org.eclipse.jetty.ee8.websocket:jetty-ee8-websocket-jetty-common."
    }
  ]
}