{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6bdba288-4629-5872-87e9-064abc89cdea", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "undertow-servlet", "purl": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.1", "type": "library", "group": "io.undertow", "bom-ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.1", "version": "1.4.27.Final-tuxcare.1", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2017-12196", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:4efd66c1-cb34-5a0f-b4b4-6efbc9167d23", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12196 does not affect version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-servlet. not_affected \u2014 CVE-2017-12196 is an Undertow Digest-auth flaw: the server failed to verify that the \"digest-uri\" value inside the Authorization header matches the actual HTTP request-line URI, enabling a MITM/credential-reuse attack (a captured Digest credential could be redirected to a different resource). Fixed upstream in 1.4.24.Final (UNDERTOW-1190). The target is undertow 1.4.27.Final (tuxcare.1 backport), which is AFTER the fix version. Direct code inspection confirms the fix is present: DigestAuthenticationMechanism.handleDigestHeader() (core/.../security/impl/DigestAuthenticationMechanism.java:233-257) compares the Authorization \"digest-uri\" token against the reconstructed request URI (path + \"?\" + query) and, as an enhancement, against the absolute request URL; on mismatch it sets 400 BAD_REQUEST and ends the exchange without authenticating, and if the DIGEST_URI token is absent it returns NOT_AUTHENTICATED. The check is on the sole Digest execution path (authenticate() -> handleDigestHeader(), line 167) and precedes credential (H(A2)) validation, with no bypass. git blame attributes lines 233-239 to upstream commit c916239d and lines 240-254 to upstream commit 11b6f0e0, both by Stuart Douglas (stuart.w.douglas@gmail.com). Both commits are ancestors of the plain upstream 1.4.27.Final commit, so the fix shipped upstream before TuxCare onboarding. Verdict: not_affected (upstream fix already present; not a TuxCare backport, so not \"already_fixed\"). [VC re-run with claude-opus-4-8, prod prompt pin d46bd7a, 2026-09-16; Sonnet run failed the author gate (A2 onboarding-merge overclaim); applied manually after git verification]", "justification": "code_not_present" } }, { "id": "CVE-2018-1114", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:797ff8d1-e235-5e68-9046-705b5ef4a56d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1114 does not affect version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-servlet. not_affected \u2014 Target is Undertow 1.4.27.Final (undertow-io/undertow) \u2014 correct product, not a false positive. CVE-2018-1114 is the file-descriptor leak where URLResource.getLastModified()/getContentLength() opened a URLConnection but closed the underlying stream only at GC finalization, exhausting file descriptors (DoS). The complete upstream fix is already present in the shipped 1.4.27.Final source. URLResource.openConnection() (core/.../resource/URLResource.java:80-110) closes the connection's input stream promptly in a finally block (IoUtils.safeClose(connection.getInputStream()), lines 100-108) and, for jar: URLs, disables caching and reads the timestamp from the underlying jar file directly (setUseCaches(false) + File.lastModified(), lines 92-98) \u2014 exactly the change in the provided patch commits 882d5884/7f22aa0090. git blame attributes these lines to upstream commits 87f4fb41fc (UNDERTOW-1081, 2017-05-24) and 7f22aa0090 (UNDERTOW-1338, 2018-04-24), both ancestors of HEAD, both predating the 1.4.27.Final release. The vulnerable close-on-finalization pattern is therefore absent from HEAD. The fix is upstream-authored (stuart.w.douglas@gmail.com / norito.agetsuma@gmail.com), NOT a TuxCare/CloudLinux backport, and URLResource.java was not modified after onboarding \u2014 so verdict is not_affected (vendor fix already shipped), justification code_not_present. [VC re-run with claude-opus-4-8, prod prompt pin d46bd7a, 2026-09-16; Sonnet run failed the author gate (A2 onboarding-merge overclaim); applied manually after git verification]", "justification": "code_not_present" } }, { "id": "CVE-2018-14642", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:55bcaaf9-7f76-51a9-88a3-38e16d635c82", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-14642 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-servlet." } }, { "id": "CVE-2019-10184", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:431feef6-2685-5ddb-a8c3-c0c6ef2ce9a7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10184 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-servlet." } }, { "id": "CVE-2019-10212", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:775a372e-774b-5799-9e88-739fdf27b694", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10212 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-servlet." } }, { "id": "CVE-2019-14888", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:84e9908e-49c4-591b-afe2-057abbe57a40", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-14888 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-servlet." } }, { "id": "CVE-2019-19343", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:7526faf8-737f-5e65-b1dd-41a15b2c20cf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-19343 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-servlet." } }, { "id": "CVE-2019-3888", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:d1c05fe3-fdcf-5642-b0be-000f2bc63971", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3888 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-servlet." } }, { "id": "CVE-2020-10687", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:a6255810-273f-5616-8d95-4ba4945510eb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10687 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-servlet." } }, { "id": "CVE-2020-10705", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:5dcd7c43-d64b-50a1-b6c0-b3b9f4b4a9a4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10705 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-servlet." } }, { "id": "CVE-2020-10719", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:92d533bd-bd6b-507e-8e4e-4c42ef6e4af5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-10719 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-servlet." } }, { "id": "CVE-2020-1745", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:31004198-e557-5008-b294-5216ea8358fd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1745 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-servlet." } }, { "id": "CVE-2020-1757", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:01d0eaec-d711-51a0-a1e6-3590a0b48e73", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1757 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-servlet." } }, { "id": "CVE-2020-27782", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:c133c224-183d-5f16-9234-61881bf272c1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27782 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-servlet." } }, { "id": "CVE-2021-20220", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:cbde9d83-5208-5282-a0cc-eee227d693a7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-20220 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-servlet." } }, { "id": "CVE-2021-3597", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:f431195d-767d-546d-92d3-2000204e392a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3597 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-servlet." } }, { "id": "CVE-2021-3629", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:227b4c0c-2ea6-5c53-bb20-dab7d31d55c4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3629 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-servlet." } }, { "id": "CVE-2021-3690", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:1bd2d959-be04-54de-bf8d-da3d33f56d4c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3690 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-servlet." } }, { "id": "CVE-2021-3859", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:565b9129-ba64-5a0d-9a55-800de9c1d077", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3859 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-servlet." } }, { "id": "CVE-2022-1259", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:f940079f-c6f3-5f0e-969a-73d5822a916d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-1259 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-servlet." } }, { "id": "CVE-2022-1319", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:c61e2929-ee91-51a4-8b00-433193b8106a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-1319 does not affect version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-servlet. Version 1.4.27.Final is not affected by CVE-2022-1319. The vulnerability was introduced in UNDERTOW-1824 (Oct 2020) when the handleBadRequest() method and related AJP response constants were added to versions 2.2.x and later. Version 1.4.27.Final (Jan 2019) predates this change and uses a simpler response mechanism that only calls httpServerExchange.endExchange() once without manual AJP packet generation, making the double-response vulnerability pattern impossible.", "justification": "code_not_present" } }, { "id": "CVE-2022-2053", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:a6ee2f75-1180-52f3-9cb1-9fa89d1d2d8f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2053 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-servlet." } }, { "id": "CVE-2022-4492", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:0dd372f1-1835-568a-a33d-33a0a19a90ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-4492 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-servlet." } }, { "id": "CVE-2023-1108", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:621a0613-9fbf-5f1d-b1f1-3d114e353d5f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-1108 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-servlet." } }, { "id": "CVE-2023-1973", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:b3b5b884-f4cb-5530-ba37-ca479d6eb19b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-1973 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-servlet." } }, { "id": "CVE-2023-3223", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:93816e57-d8ad-55ec-af96-5b7cd7fe0d8b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-3223 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-servlet." } }, { "id": "CVE-2023-4639", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:3b21c1da-3317-5b25-b54a-9a50b2f7dd94", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-4639 is fixed in version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-servlet." } }, { "id": "CVE-2024-1459", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:e1b17f4e-a567-5e7e-9a96-eb35c94b0732", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-1459 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-servlet." } }, { "id": "CVE-2024-1635", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:2b8f38b4-0c74-5f27-9876-6e302b2530ed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-1635 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-servlet." } }, { "id": "CVE-2024-3653", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:6dcb3a9b-d6f3-5090-876c-8982f5fb5d7e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-3653 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-servlet." } }, { "id": "CVE-2024-3884", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:72a81f28-5623-5e36-8103-a23b44e354fa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-3884 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-servlet." } }, { "id": "CVE-2024-4027", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:9c7fca7f-55cb-52c0-8b41-1b8bf1788d01", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-4027 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-servlet." } }, { "id": "CVE-2024-4109", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:7c8cd7a5-851f-5754-b226-e75855f2d6e2", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-4109 is a false positive for io.undertow:undertow-servlet 1.4.27.Final-tuxcare.1." } }, { "id": "CVE-2024-5971", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:705b5d72-47e4-593b-9070-9d227ed5fa45", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-5971 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-servlet." } }, { "id": "CVE-2024-6162", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:ee1481d5-d85b-5e4d-bcd9-0f0c8943fea8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6162 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-servlet." } }, { "id": "CVE-2024-7885", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:a49cb258-c780-5d0c-8199-d5a562c24fb9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7885 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-servlet." } }, { "id": "CVE-2025-12543", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:ac7f435a-54c6-5a80-a292-cedad5071483", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-12543 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-servlet." } }, { "id": "CVE-2025-9784", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:e97eed4b-d5be-5e17-9b5f-693a46900538", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-9784 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-servlet." } }, { "id": "CVE-2026-28367", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:49cb709c-086a-53ca-b09b-b1e69965a62c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28367 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-servlet." } }, { "id": "CVE-2026-28368", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:c41e474a-c5fc-595f-ba09-2d4a18ecfb67", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28368 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-servlet." } }, { "id": "CVE-2026-28369", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:9f88b792-e5ac-510d-8749-cfb104760f61", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-28369 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-servlet." } }, { "id": "CVE-2026-3260", "affects": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.1" } ], "bom-ref": "urn:uuid:bd0260e2-3706-5fcd-98a5-3ed6cd7313ec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-3260 affects version 1.4.27.Final-tuxcare.1 of io.undertow:undertow-servlet." } } ], "dependencies": [ { "ref": "pkg:maven/io.undertow/undertow-servlet@1.4.27.Final-tuxcare.1" } ] }