{
  "@id": "urn:uuid:aae8d9bb-0934-4ba4-9246-6f22448e92bd",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 11,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T20:55:00.104909+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.3.6.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.3.6.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2018-1196 does not affect version 2.3.6.RELEASE-tuxcare.3 of org.springframework.boot:spring-boot. not_affected \u2014 CVE-2018-1196 affects Spring Boot's embedded launch script via symlink attacks allowing arbitrary file ownership changes. The target (Spring Boot 2.3.6.RELEASE-tuxcare.6) is NOT AFFECTED because the upstream vendor fix (commit 6ae960d295) shipped in the base release before TuxCare maintenance began. The launch.script contains complete defenses: existence checks `[[ ! -e \"$PID_FOLDER\" ]]` and `[...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1196"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1196 affects Spring Boot's embedded launch script via symlink attacks allowing arbitrary file ownership changes. The target (Spring Boot 2.3.6.RELEASE-tuxcare.6) is NOT AFFECTED because the upstream vendor fix (commit 6ae960d295) shipped in the base release before TuxCare maintenance began. The launch.script contains complete defenses: existence checks `[[ ! -e \"$PID_FOLDER\" ]]` and `[..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.3.6.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.3.6.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:04:11.456857+00:00",
      "status_notes": "Vulnerability CVE-2022-27772 does not affect version 2.3.6.RELEASE-tuxcare.3 of org.springframework.boot:spring-boot. CVE-2022-27772 temporary directory hijacking vulnerability is not present in Spring Boot 2.3.6.RELEASE. The vulnerable code pattern (File.createTempFile \u2192 delete \u2192 mkdir) was fixed in upstream commit 667ccdae84 by Andy Wilkinson, which was included in the upstream v2.3.6.RELEASE before TuxCare started maintaining this branch. The fix uses Files.createTempDirectory() which atomically creates a temp directory with proper permissions, eliminating the race condition.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.11.RELEASE), NVD (< 2.2.11), Snyk (< 2.2.11.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-27772"
      },
      "impact_statement": "CVE-2022-27772 temporary directory hijacking vulnerability is not present in Spring Boot 2.3.6.RELEASE. The vulnerable code pattern (File.createTempFile \u2192 delete \u2192 mkdir) was fixed in upstream commit 667ccdae84 by Andy Wilkinson, which was included in the upstream v2.3.6.RELEASE before TuxCare started maintaining this branch. The fix uses Files.createTempDirectory() which atomically creates a temp directory with proper permissions, eliminating the race condition.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.11.RELEASE), NVD (< 2.2.11), Snyk (< 2.2.11.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.3.6.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.3.6.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-20T10:05:00.136501+00:00",
      "status_notes": "Vulnerability CVE-2023-38286 is a false positive for org.springframework.boot:spring-boot 2.3.6.RELEASE-tuxcare.3. direct vulnerability is in Thymeleaf project",
      "vulnerability": {
        "name": "CVE-2023-38286"
      },
      "impact_statement": "direct vulnerability is in Thymeleaf project"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.3.6.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.3.6.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-22235 affects version 2.3.6.RELEASE-tuxcare.3 of org.springframework.boot:spring-boot, and is fixed in 2.3.6.RELEASE-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2025-22235"
      },
      "action_statement": "Vulnerability CVE-2025-22235 affects version 2.3.6.RELEASE-tuxcare.3 of org.springframework.boot:spring-boot, and is fixed in 2.3.6.RELEASE-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.3.6.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.3.6.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40973 affects version 2.3.6.RELEASE-tuxcare.3 of org.springframework.boot:spring-boot, and is fixed in 2.3.6.RELEASE-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-40973"
      },
      "action_statement": "Vulnerability CVE-2026-40973 affects version 2.3.6.RELEASE-tuxcare.3 of org.springframework.boot:spring-boot, and is fixed in 2.3.6.RELEASE-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.3.6.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.3.6.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40975 affects version 2.3.6.RELEASE-tuxcare.3 of org.springframework.boot:spring-boot, and is fixed in 2.3.6.RELEASE-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-40975"
      },
      "action_statement": "Vulnerability CVE-2026-40975 affects version 2.3.6.RELEASE-tuxcare.3 of org.springframework.boot:spring-boot, and is fixed in 2.3.6.RELEASE-tuxcare.5."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.3.6.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.3.6.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T20:55:00.104909+00:00",
      "status_notes": "Vulnerability CVE-2026-40976 does not affect version 2.3.6.RELEASE-tuxcare.3 of org.springframework.boot:spring-boot. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. The servlet patch already contains a health-presence check before the fix; the fix moves catch-all authentication outside that condition (patch:46, patch:57). In this version, actuator-autoconfigure requires spring-boot-actuator, which contains HealthEndpoint, so omitting spring-boot-health does not remove that class (actuator-autoconfigure/build.gradle:23, HealthEndpoint.java:40). For servlet applications with Spring Security and no custom adapter, management auto-configuration imports its security adapter without a health-presence condition (ManagementWebSecurityAutoConfiguration.java:45). That adapter permits health/info requests and unconditionally requires authentication for every other request, so the authorization-skipping path repaired by the patch is absent (ManagementWebSecurityConfigurerAdapter.java:42).",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-40976"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. The servlet patch already contains a health-presence check before the fix; the fix moves catch-all authentication outside that condition (patch:46, patch:57). In this version, actuator-autoconfigure requires spring-boot-actuator, which contains HealthEndpoint, so omitting spring-boot-health does not remove that class (actuator-autoconfigure/build.gradle:23, HealthEndpoint.java:40). For servlet applications with Spring Security and no custom adapter, management auto-configuration imports its security adapter without a health-presence condition (ManagementWebSecurityAutoConfiguration.java:45). That adapter permits health/info requests and unconditionally requires authentication for every other request, so the authorization-skipping path repaired by the patch is absent (ManagementWebSecurityConfigurerAdapter.java:42)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.3.6.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.3.6.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40977 affects version 2.3.6.RELEASE-tuxcare.3 of org.springframework.boot:spring-boot, and is fixed in 2.3.6.RELEASE-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-40977"
      },
      "action_statement": "Vulnerability CVE-2026-40977 affects version 2.3.6.RELEASE-tuxcare.3 of org.springframework.boot:spring-boot, and is fixed in 2.3.6.RELEASE-tuxcare.5."
    }
  ]
}