{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:4e2d7b9d-f1e3-5fe4-83c4-3e9a034bfa40", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.57.v20241219-tuxcare.5", "type": "library", "group": "org.eclipse.jetty", "name": "infinispan-remote", "version": "9.4.57.v20241219-tuxcare.5", "purl": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.57.v20241219-tuxcare.5" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:082a82a7-4b0b-5ae6-b3bb-c96e21093ad4", "id": "CVE-2020-25711", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-25711 affects version 9.4.57.v20241219-tuxcare.5 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.57.v20241219-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:b01ef7ae-9c36-51bc-bf2f-27f483e0db62", "id": "CVE-2020-27216", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 9.4.57.v20241219-tuxcare.5 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.57.v20241219-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:dcb10239-b0a1-5a58-ac64-ccadec520dad", "id": "CVE-2021-28169", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-28169 does not affect version 9.4.57.v20241219-tuxcare.5 of org.eclipse.jetty:infinispan-remote. Version 9.4.57.v20241219 is not vulnerable. Summary: The target repository (Jetty 9.4.57.v20241219) is NOT vulnerable to CVE-2021-28169. The vulnerability was fixed in version 9.4.41.v20210516, and the current version contains the security patch that prevents double URL encoding attacks on ConcatServlet. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.57.v20241219-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:99f1c9b3-6c8d-5a77-bf99-a9c0c6724079", "id": "CVE-2021-34428", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-34428 does not affect version 9.4.57.v20241219-tuxcare.5 of org.eclipse.jetty:infinispan-remote. Version 9.4.57.v20241219 is not affected by CVE-2021-34428: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.57.v20241219-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:3b7fa617-cc62-5dea-bafc-015e7a9612de", "id": "CVE-2023-36478", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-36478 does not affect version 9.4.57.v20241219-tuxcare.5 of org.eclipse.jetty:infinispan-remote. Version 9.4.57.v20241219 is not vulnerable. Summary: CVE-2023-36478 has been fully mitigated. The vulnerable checkSize method with integer overflow has been removed, and all protective measures from the vendor patch are present in the target repository. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.57.v20241219-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:2173976e-b4af-594a-ba11-8ded0acaeb62", "id": "CVE-2023-36479", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36479 affects version 9.4.57.v20241219-tuxcare.5 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.57.v20241219-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f4270357-1c72-58cf-8667-a61a009c7da3", "id": "CVE-2023-40167", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-40167 affects version 9.4.57.v20241219-tuxcare.5 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.57.v20241219-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a87c0d7a-ef74-518c-b45b-c1c2a2162ad1", "id": "CVE-2023-41900", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-41900 does not affect version 9.4.57.v20241219-tuxcare.5 of org.eclipse.jetty:infinispan-remote. Version 9.4.57.v20241219 is not vulnerable. Summary: CVE-2023-41900 fix is present in the target repository. The vulnerable code pattern has been corrected. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.57.v20241219-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c9c00426-8e71-5ce4-90e8-0a656d60f407", "id": "CVE-2024-22201", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-22201 does not affect version 9.4.57.v20241219-tuxcare.5 of org.eclipse.jetty:infinispan-remote. Version 9.4.57.v20241219 is not vulnerable. Summary: The target repository (Jetty 9.4.57.v20241219) contains the fix for CVE-2024-22201. The vulnerable idle timeout handling has been patched to properly terminate connections even when TCP congested. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.57.v20241219-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:7bdc0219-54c3-5c44-9b47-82f7e4e80fa9", "id": "CVE-2024-6762", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6762 affects version 9.4.57.v20241219-tuxcare.5 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.57.v20241219-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:6215945a-58cc-51b3-8a07-ae3b184874b1", "id": "CVE-2024-6763", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-6763 does not affect version 9.4.57.v20241219-tuxcare.5 of org.eclipse.jetty:infinispan-remote. fix for CVE for this version has been already backported by the original developers, so this brunch is not vulnerable" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.57.v20241219-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c0ae1615-5997-5baf-8208-0af0ef5a5c3a", "id": "CVE-2024-8184", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-8184 does not affect version 9.4.57.v20241219-tuxcare.5 of org.eclipse.jetty:infinispan-remote. Version 9.4.57.v20241219 is not vulnerable. Summary: The target repository has already been patched for CVE-2024-8184. The vulnerable get/putIfAbsent pattern has been replaced with atomic compute operations and reference counting, preventing the memory leak that causes DoS. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.57.v20241219-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:5901f0a2-f9a3-5155-937b-da0b3d0dfe81", "id": "CVE-2025-11143", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-11143 is fixed in version 9.4.57.v20241219-tuxcare.5 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.57.v20241219-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:98c8fe35-7936-56fd-b87a-c83aeed36acb", "id": "CVE-2025-5115", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-5115 is fixed in version 9.4.57.v20241219-tuxcare.5 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.57.v20241219-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d10cb8eb-d486-55fa-b0ea-c73aee6dc145", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 9.4.57.v20241219-tuxcare.5 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.57.v20241219-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a7c6510f-3f16-556c-8196-b3c5ccda552b", "id": "CVE-2026-10051", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 9.4.57.v20241219-tuxcare.5 of org.eclipse.jetty:infinispan-remote. not_affected \u2014 Jetty 9.4.57.v20241219-tuxcare.4 is NOT affected by CVE-2026-10051. The vulnerability targets Jetty 12.x architecture where the _trailers field in HttpConnection was never reset between requests. Jetty 9.4.57 uses a different architecture where _trailers fields exist in HttpChannelOverHttp and HttpChannel classes, and BOTH are properly cleared to null in their respective recycle() methods, whic..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.57.v20241219-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:7256fdb6-1a1a-5cf8-aa00-b1586f0e3407", "id": "CVE-2026-1605", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 9.4.57.v20241219-tuxcare.5 of org.eclipse.jetty:infinispan-remote. Version 9.4.57.v20241219 is not vulnerable. Summary: Target repository is Jetty 9.4.57.v20241219, which is not in the affected version range for CVE-2026-1605 (Jetty 12.0.0-12.0.31 and 12.1.0-12.0.5). The architecture and resource management patterns are fundamentally different from Jetty 12.x, and the specific vulnerability pattern does not exist in this version. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.57.v20241219-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:99a72fe4-f759-55b6-b799-7fa0c3ed1653", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 9.4.57.v20241219-tuxcare.5 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.57.v20241219-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:2afd3648-7192-50db-876f-38633dfbf182", "id": "CVE-2026-5795", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-5795 is fixed in version 9.4.57.v20241219-tuxcare.5 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.57.v20241219-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:b02a918c-c411-52f2-9cc0-4d7d2670d23b", "id": "CVE-2026-6790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 9.4.57.v20241219-tuxcare.5 of org.eclipse.jetty:infinispan-remote." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.57.v20241219-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c64a466f-7e4e-51a8-a4ac-4f10955325f7", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 9.4.57.v20241219-tuxcare.5 of org.eclipse.jetty:infinispan-remote. not_affected \u2014 The target Jetty 9.4.57.v20241219 is not affected by CVE-2026-8384. The vulnerability exists in Jetty 12.1.8's unified canonicalPath() method which handles both semicolon stripping and dot normalization in a single pass. Jetty 9.4 uses a fundamentally different two-pass architecture where decodePath() strips semicolons first, then canonicalPath() normalizes dot segments. The specific vulnerabil..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.57.v20241219-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:53925764-3fc4-5320-8d6d-6e543cee27b4", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh does not affect version 9.4.57.v20241219-tuxcare.5 of org.eclipse.jetty:infinispan-remote. Version 9.4.57.v20241219 is not vulnerable. Summary: The target repository has the core XXE vulnerability fix applied in XmlParser.java. The vulnerable fallback entity resolution has been removed, preventing XXE attacks. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.57.v20241219-tuxcare.5" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty/infinispan-remote@9.4.57.v20241219-tuxcare.5" } ] }