{
  "@id": "urn:uuid:99cb2cdf-11bb-4a3f-bfd5-986423b8c16d",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 14,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T20:55:00.104909+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@2.7.18-tuxcare.21",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@2.7.18-tuxcare.21"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2023-20873 does not affect version 2.7.18-tuxcare.21 of org.springframework.boot:spring-boot-actuator-autoconfigure. CVE-2023-20873 is NOT present in Spring Boot 2.7.18-tuxcare.23. The vulnerability (security bypass via wildcard path matching in Cloud Foundry actuator integration) was fixed in the upstream Spring Boot release that TuxCare onboarded. The original fix (commit 3522714c13 from April 2023) introduced specific endpoint-based path matching. Although this implementation was later modified by commit e33f18c472 (April 2026, fixing CVE-2026-22733), the current code maintains equivalent protection via a catch-all HTTP 403 handler that blocks access to unregistered paths under /cloudfoundryapplication/, preventing the security bypass. The vulnerable pattern (allowing arbitrary path access) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.0.0, < 3.0.6; >= 2.7.0, < 2.7.11; >= 2.6.0, < 2.6.15; < 2.5.15), NVD (< 2.5.15; >= 2.6.0, < 2.6.14; >= 2.7.0, < 2.7.11; >= 3.0.0, < 3.0.6), cve.org (>= 3.0.0, <= 3.0.5; >= 2.7.0, <= 2.7.10), Snyk (< 2.5.15; >= 2.6.0, < 2.6.15; >= 2.7.0, < 2.7.11; >= 3.0.0, < 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-20873"
      },
      "impact_statement": "CVE-2023-20873 is NOT present in Spring Boot 2.7.18-tuxcare.23. The vulnerability (security bypass via wildcard path matching in Cloud Foundry actuator integration) was fixed in the upstream Spring Boot release that TuxCare onboarded. The original fix (commit 3522714c13 from April 2023) introduced specific endpoint-based path matching. Although this implementation was later modified by commit e33f18c472 (April 2026, fixing CVE-2026-22733), the current code maintains equivalent protection via a catch-all HTTP 403 handler that blocks access to unregistered paths under /cloudfoundryapplication/, preventing the security bypass. The vulnerable pattern (allowing arbitrary path access) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.0.0, < 3.0.6; >= 2.7.0, < 2.7.11; >= 2.6.0, < 2.6.15; < 2.5.15), NVD (< 2.5.15; >= 2.6.0, < 2.6.14; >= 2.7.0, < 2.7.11; >= 3.0.0, < 3.0.6), cve.org (>= 3.0.0, <= 3.0.5; >= 2.7.0, <= 2.7.10), Snyk (< 2.5.15; >= 2.6.0, < 2.6.15; >= 2.7.0, < 2.7.11; >= 3.0.0, < 3.0.6)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@2.7.18-tuxcare.21",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@2.7.18-tuxcare.21"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-38286 is fixed in version 2.7.18-tuxcare.21 of org.springframework.boot:spring-boot-actuator-autoconfigure.",
      "vulnerability": {
        "name": "CVE-2023-38286"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@2.7.18-tuxcare.21",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@2.7.18-tuxcare.21"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-22235 is fixed in version 2.7.18-tuxcare.21 of org.springframework.boot:spring-boot-actuator-autoconfigure.",
      "vulnerability": {
        "name": "CVE-2025-22235"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@2.7.18-tuxcare.21",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@2.7.18-tuxcare.21"
          }
        }
      ],
      "timestamp": "2026-11-09T20:55:00.104909+00:00",
      "status_notes": "Vulnerability CVE-2026-40976 does not affect version 2.7.18-tuxcare.21 of org.springframework.boot:spring-boot-actuator-autoconfigure. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. Actuator-autoconfigure requires actuator through build.gradle:20, which contains HealthEndpoint.java:42. The management configuration activates for servlet applications using default security (ManagementWebSecurityAutoConfiguration.java:54). It permits health requests, unconditionally requires authentication for every remaining request, and builds the chain; the vulnerable conditional omission is absent (ManagementWebSecurityAutoConfiguration.java:62). Even a hypothetical bean-creation failure would enter startup failure handling and close the context, rather than establish the claimed permissive application (SpringApplication.java:317, SpringApplication.java:784).",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-40976"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. Actuator-autoconfigure requires actuator through build.gradle:20, which contains HealthEndpoint.java:42. The management configuration activates for servlet applications using default security (ManagementWebSecurityAutoConfiguration.java:54). It permits health requests, unconditionally requires authentication for every remaining request, and builds the chain; the vulnerable conditional omission is absent (ManagementWebSecurityAutoConfiguration.java:62). Even a hypothetical bean-creation failure would enter startup failure handling and close the context, rather than establish the claimed permissive application (SpringApplication.java:317, SpringApplication.java:784)."
    }
  ]
}