{ "@id": "urn:uuid:60943c0e-9f0a-4c0f-b98f-e5af82cd3518", "role": "Document Creator", "author": "https://tuxcare.com", "version": 13, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-09T20:55:00.104909+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.boot/spring-boot@2.5.15-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.boot/spring-boot@2.5.15-tuxcare.1" } } ], "timestamp": "2026-11-02T16:42:00.216861+00:00", "status_notes": "Vulnerability CVE-2018-1196 does not affect version 2.5.15-tuxcare.1 of org.springframework.boot:spring-boot. not_affected \u2014 CVE-2018-1196 describes a symlink attack vulnerability in Spring Boot's embedded launch script that allowed the run_user to gain ownership of arbitrary files. The vulnerability existed because the script unconditionally changed ownership of PID folders, PID files, and log files to run_user without checking if they already existed. An attacker with shell access could create symlinks pointing to ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1196" }, "impact_statement": "not_affected \u2014 CVE-2018-1196 describes a symlink attack vulnerability in Spring Boot's embedded launch script that allowed the run_user to gain ownership of arbitrary files. The vulnerability existed because the script unconditionally changed ownership of PID folders, PID files, and log files to run_user without checking if they already existed. An attacker with shell access could create symlinks pointing to ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.boot/spring-boot@2.5.15-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.boot/spring-boot@2.5.15-tuxcare.1" } } ], "timestamp": "2026-11-04T09:07:59.808671+00:00", "status_notes": "Vulnerability CVE-2022-27772 does not affect version 2.5.15-tuxcare.1 of org.springframework.boot:spring-boot. CVE-2022-27772 affects Spring Boot versions prior to v2.2.11.RELEASE due to a temporary directory hijacking vulnerability in AbstractConfigurableWebServerFactory.createTempDir(). The target repository (spring-boot 2.5.15-tuxcare.1) is NOT vulnerable. The fix was introduced by upstream Spring Boot developer Andy Wilkinson in commit 667ccdae84 (October 2020) and was already present in the upstream Spring Boot 2.5.15 release (April 2023) that TuxCare onboarded. The vulnerable code pattern (File.createTempFile \u2192 delete \u2192 mkdir race condition) has been replaced with the secure Files.createTempDirectory() method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.11.RELEASE), NVD (< 2.2.11), Snyk (< 2.2.11.RELEASE).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-27772" }, "impact_statement": "CVE-2022-27772 affects Spring Boot versions prior to v2.2.11.RELEASE due to a temporary directory hijacking vulnerability in AbstractConfigurableWebServerFactory.createTempDir(). The target repository (spring-boot 2.5.15-tuxcare.1) is NOT vulnerable. The fix was introduced by upstream Spring Boot developer Andy Wilkinson in commit 667ccdae84 (October 2020) and was already present in the upstream Spring Boot 2.5.15 release (April 2023) that TuxCare onboarded. The vulnerable code pattern (File.createTempFile \u2192 delete \u2192 mkdir race condition) has been replaced with the secure Files.createTempDirectory() method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.11.RELEASE), NVD (< 2.2.11), Snyk (< 2.2.11.RELEASE)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.boot/spring-boot@2.5.15-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.boot/spring-boot@2.5.15-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-22235 is fixed in version 2.5.15-tuxcare.1 of org.springframework.boot:spring-boot.", "vulnerability": { "name": "CVE-2025-22235" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.boot/spring-boot@2.5.15-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.boot/spring-boot@2.5.15-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40973 is fixed in version 2.5.15-tuxcare.1 of org.springframework.boot:spring-boot.", "vulnerability": { "name": "CVE-2026-40973" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.boot/spring-boot@2.5.15-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.boot/spring-boot@2.5.15-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40975 affects version 2.5.15-tuxcare.1 of org.springframework.boot:spring-boot.", "vulnerability": { "name": "CVE-2026-40975" }, "action_statement": "Vulnerability CVE-2026-40975 affects version 2.5.15-tuxcare.1 of org.springframework.boot:spring-boot." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.boot/spring-boot@2.5.15-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.boot/spring-boot@2.5.15-tuxcare.1" } } ], "timestamp": "2026-11-09T20:55:00.104909+00:00", "status_notes": "Vulnerability CVE-2026-40976 does not affect version 2.5.15-tuxcare.1 of org.springframework.boot:spring-boot. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. The patch moves the authenticated catch-all outside a health-class-presence condition that previously guarded the entire servlet authorization block (patches/01-874f6294b91d.patch:42\u201358). The target already applies health `permitAll()` followed by unconditional `anyRequest().authenticated()` and builds that chain (ManagementWebSecurityAutoConfiguration.java:63\u201373). This configuration is registered for auto-configuration (spring.factories:91). Actuator-autoconfigure requires actuator through an `api` dependency (build.gradle:30), which supplies the referenced health class (HealthEndpoint.java:39\u201340). The fallback likewise requires authentication for every request (SpringBootWebSecurityConfiguration.java:47\u201349), and its condition checks security classes and existing security beans, without a health-presence condition (DefaultWebSecurityCondition.java:39\u201345).", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-40976" }, "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. The patch moves the authenticated catch-all outside a health-class-presence condition that previously guarded the entire servlet authorization block (patches/01-874f6294b91d.patch:42\u201358). The target already applies health `permitAll()` followed by unconditional `anyRequest().authenticated()` and builds that chain (ManagementWebSecurityAutoConfiguration.java:63\u201373). This configuration is registered for auto-configuration (spring.factories:91). Actuator-autoconfigure requires actuator through an `api` dependency (build.gradle:30), which supplies the referenced health class (HealthEndpoint.java:39\u201340). The fallback likewise requires authentication for every request (SpringBootWebSecurityConfiguration.java:47\u201349), and its condition checks security classes and existing security beans, without a health-presence condition (DefaultWebSecurityCondition.java:39\u201345)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.boot/spring-boot@2.5.15-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.boot/spring-boot@2.5.15-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40977 affects version 2.5.15-tuxcare.1 of org.springframework.boot:spring-boot.", "vulnerability": { "name": "CVE-2026-40977" }, "action_statement": "Vulnerability CVE-2026-40977 affects version 2.5.15-tuxcare.1 of org.springframework.boot:spring-boot." } ] }