{
  "@id": "urn:uuid:138bca89-e4a5-4a5f-854b-75d845e31d84",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 10,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T04:13:00.045658+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.4.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.4.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2018-1196 does not affect version 2.4.5-tuxcare.2 of org.springframework.boot:spring-boot. not_affected \u2014 The target Spring Boot 2.4.5-tuxcare.5 is NOT AFFECTED by CVE-2018-1196. The vulnerability was a symlink attack in the embedded launch script that allowed run_user to gain ownership of arbitrary files. The upstream Spring Boot project fixed this in commits 9b8cb9a463 (Jan 2018) and d59000ceb15 (Feb 2018), well before the 2.4.5 release (Apr 2021). The fix is present in the target's launch.script...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1196"
      },
      "impact_statement": "not_affected \u2014 The target Spring Boot 2.4.5-tuxcare.5 is NOT AFFECTED by CVE-2018-1196. The vulnerability was a symlink attack in the embedded launch script that allowed run_user to gain ownership of arbitrary files. The upstream Spring Boot project fixed this in commits 9b8cb9a463 (Jan 2018) and d59000ceb15 (Feb 2018), well before the 2.4.5 release (Apr 2021). The fix is present in the target's launch.script..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.4.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.4.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2022-27772 does not affect version 2.4.5-tuxcare.2 of org.springframework.boot:spring-boot. Spring Boot 2.4.5-tuxcare.5 is not affected by CVE-2022-27772. The vulnerable temporary directory creation pattern (File.createTempFile \u2192 delete \u2192 mkdir) described in the CVE is absent from the target. The upstream fix by Andy Wilkinson (commit 667ccdae84) replaced the race-prone three-step pattern with atomic Files.createTempDirectory(), eliminating the hijacking vulnerability. This fix was included in upstream release v2.2.11.RELEASE, and version 2.4.5 inherited it before TuxCare's onboarding (first TuxCare commit: 5d95ebfaad). Both affected files\u2014AbstractConfigurableWebServerFactory.java and SpringBootMockServletContext.java\u2014contain the fixed code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.11.RELEASE), NVD (< 2.2.11), Snyk (< 2.2.11.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-27772"
      },
      "impact_statement": "Spring Boot 2.4.5-tuxcare.5 is not affected by CVE-2022-27772. The vulnerable temporary directory creation pattern (File.createTempFile \u2192 delete \u2192 mkdir) described in the CVE is absent from the target. The upstream fix by Andy Wilkinson (commit 667ccdae84) replaced the race-prone three-step pattern with atomic Files.createTempDirectory(), eliminating the hijacking vulnerability. This fix was included in upstream release v2.2.11.RELEASE, and version 2.4.5 inherited it before TuxCare's onboarding (first TuxCare commit: 5d95ebfaad). Both affected files\u2014AbstractConfigurableWebServerFactory.java and SpringBootMockServletContext.java\u2014contain the fixed code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.11.RELEASE), NVD (< 2.2.11), Snyk (< 2.2.11.RELEASE)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.4.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.4.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-38286 affects version 2.4.5-tuxcare.2 of org.springframework.boot:spring-boot.",
      "vulnerability": {
        "name": "CVE-2023-38286"
      },
      "action_statement": "Vulnerability CVE-2023-38286 affects version 2.4.5-tuxcare.2 of org.springframework.boot:spring-boot."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.4.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.4.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-22235 is fixed in version 2.4.5-tuxcare.2 of org.springframework.boot:spring-boot.",
      "vulnerability": {
        "name": "CVE-2025-22235"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.4.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.4.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40973 is fixed in version 2.4.5-tuxcare.2 of org.springframework.boot:spring-boot.",
      "vulnerability": {
        "name": "CVE-2026-40973"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.4.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.4.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40975 is fixed in version 2.4.5-tuxcare.2 of org.springframework.boot:spring-boot.",
      "vulnerability": {
        "name": "CVE-2026-40975"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.4.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.4.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-10T04:13:00.045658+00:00",
      "status_notes": "Vulnerability CVE-2026-40976 does not affect version 2.4.5-tuxcare.2 of org.springframework.boot:spring-boot. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because its default servlet security chain unconditionally requires authentication for all requests except health and info endpoints. In spring-boot-project/spring-boot-actuator-autoconfigure/src/main/java/org/springframework/boot/actuate/autoconfigure/security/servlet/ManagementWebSecurityAutoConfiguration.java:60, the chain applies anyRequest().authenticated() and builds the chain without a health-class condition that could omit authentication.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-40976"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because its default servlet security chain unconditionally requires authentication for all requests except health and info endpoints. In spring-boot-project/spring-boot-actuator-autoconfigure/src/main/java/org/springframework/boot/actuate/autoconfigure/security/servlet/ManagementWebSecurityAutoConfiguration.java:60, the chain applies anyRequest().authenticated() and builds the chain without a health-class condition that could omit authentication."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.4.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.4.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40977 is fixed in version 2.4.5-tuxcare.2 of org.springframework.boot:spring-boot.",
      "vulnerability": {
        "name": "CVE-2026-40977"
      }
    }
  ]
}