{
  "@id": "urn:uuid:bee0d325-b7c2-439b-9355-a94a2ef81cab",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 14,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T01:45:09.863951+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.28.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.28.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-27216 does not affect version 10.0.28.tuxcare0002 of org.eclipse.jetty:jetty-webapp. CVE-2020-27216 (temp directory race condition) is NOT present in the target. The upstream Eclipse/Jetty fix (commit 53e0e0e9b25 from Oct 2020) was already included in Jetty 10.0.28 before TuxCare's base. The target uses secure atomic directory creation via Files.createTempDirectory() (lines 104, 236) instead of the vulnerable File.createTempFile() \u2192 delete() \u2192 mkdirs() race pattern.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-27216"
      },
      "impact_statement": "CVE-2020-27216 (temp directory race condition) is NOT present in the target. The upstream Eclipse/Jetty fix (commit 53e0e0e9b25 from Oct 2020) was already included in Jetty 10.0.28 before TuxCare's base. The target uses secure atomic directory creation via Files.createTempDirectory() (lines 104, 236) instead of the vulnerable File.createTempFile() \u2192 delete() \u2192 mkdirs() race pattern."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.28.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.28.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-10-29T01:02:19.900071+00:00",
      "status_notes": "Vulnerability CVE-2021-28164 affects version 10.0.28.tuxcare0002 of org.eclipse.jetty:jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2021-28164"
      },
      "action_statement": "Vulnerability CVE-2021-28164 affects version 10.0.28.tuxcare0002 of org.eclipse.jetty:jetty-webapp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.28.tuxcare0002",
          "identifiers": {
            "purl": "pkg:maven/org.eclipse.jetty/jetty-webapp@10.0.28.tuxcare0002"
          }
        }
      ],
      "timestamp": "2026-10-29T01:02:19.900071+00:00",
      "status_notes": "Vulnerability CVE-2021-34429 affects version 10.0.28.tuxcare0002 of org.eclipse.jetty:jetty-webapp.",
      "vulnerability": {
        "name": "CVE-2021-34429"
      },
      "action_statement": "Vulnerability CVE-2021-34429 affects version 10.0.28.tuxcare0002 of org.eclipse.jetty:jetty-webapp."
    }
  ]
}