{
  "@id": "urn:uuid:a7cb059e-0f33-4ac3-96b9-cd5141228d6b",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 10,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T22:52:23.660151+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-loader@3.3.13-tuxcare.16",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-loader@3.3.13-tuxcare.16"
          }
        }
      ],
      "timestamp": "2026-11-02T22:52:23.660151+00:00",
      "status_notes": "Vulnerability CVE-2024-38807 does not affect version 3.3.13-tuxcare.16 of org.springframework.boot:spring-boot-loader. not_affected \u2014 Spring Boot 3.3.13-tuxcare.18 is NOT affected by CVE-2024-38807. The upstream fix (commit 0b24ee857189e139f48826bf2aef10ae8680c11b \"Improve loading of jar entry certificates\" by Andy Wilkinson) was already present in the upstream Spring Boot 3.3.13 release that TuxCare onboarded. The fix introduces JarEntriesStream class that validates JAR entry consistency (directory flag, compression method, ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38807"
      },
      "impact_statement": "not_affected \u2014 Spring Boot 3.3.13-tuxcare.18 is NOT affected by CVE-2024-38807. The upstream fix (commit 0b24ee857189e139f48826bf2aef10ae8680c11b \"Improve loading of jar entry certificates\" by Andy Wilkinson) was already present in the upstream Spring Boot 3.3.13 release that TuxCare onboarded. The fix introduces JarEntriesStream class that validates JAR entry consistency (directory flag, compression method, ..."
    }
  ]
}