{
  "@id": "urn:uuid:6b364f5f-bde2-4423-b582-911b3ab51282",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 11,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:05:53.304095+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.7.16-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.7.16-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2018-1196 does not affect version 2.7.16-tuxcare.6 of org.springframework.boot:spring-boot. not_affected \u2014 The target Spring Boot 2.7.16 repository is NOT affected by CVE-2018-1196. The vulnerability (symlink attack allowing arbitrary file ownership takeover) was fixed in upstream Spring Boot 1.5.10 and 2.0.0.RC1 (January 2018). The fix was already present in Spring Boot 2.7.16 when TuxCare onboarded it. The launch.script at lines 178-189 contains the defensive checks that prevent chowning existing ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1196"
      },
      "impact_statement": "not_affected \u2014 The target Spring Boot 2.7.16 repository is NOT affected by CVE-2018-1196. The vulnerability (symlink attack allowing arbitrary file ownership takeover) was fixed in upstream Spring Boot 1.5.10 and 2.0.0.RC1 (January 2018). The fix was already present in Spring Boot 2.7.16 when TuxCare onboarded it. The launch.script at lines 178-189 contains the defensive checks that prevent chowning existing ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.7.16-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.7.16-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2022-27772 does not affect version 2.7.16-tuxcare.6 of org.springframework.boot:spring-boot. CVE-2022-27772 is NOT present in Spring Boot 2.7.16. The vulnerable temporary directory hijacking pattern (create temp file \u2192 delete \u2192 mkdir race condition) was fixed by upstream Spring Boot in commit 667ccdae84 (Oct 2020) by Andy Wilkinson, which replaced the insecure pattern with Files.createTempDirectory() - an atomic operation with secure permissions. This fix was already present in the upstream Spring Boot 2.7.16 release that TuxCare onboarded (commit 5bcc3876e7). Both affected files (AbstractConfigurableWebServerFactory.java and SpringBootMockServletContext.java) contain the secure implementation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.11.RELEASE), NVD (< 2.2.11), Snyk (< 2.2.11.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-27772"
      },
      "impact_statement": "CVE-2022-27772 is NOT present in Spring Boot 2.7.16. The vulnerable temporary directory hijacking pattern (create temp file \u2192 delete \u2192 mkdir race condition) was fixed by upstream Spring Boot in commit 667ccdae84 (Oct 2020) by Andy Wilkinson, which replaced the insecure pattern with Files.createTempDirectory() - an atomic operation with secure permissions. This fix was already present in the upstream Spring Boot 2.7.16 release that TuxCare onboarded (commit 5bcc3876e7). Both affected files (AbstractConfigurableWebServerFactory.java and SpringBootMockServletContext.java) contain the secure implementation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.11.RELEASE), NVD (< 2.2.11), Snyk (< 2.2.11.RELEASE)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.7.16-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.7.16-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-38286 affects version 2.7.16-tuxcare.6 of org.springframework.boot:spring-boot.",
      "vulnerability": {
        "name": "CVE-2023-38286"
      },
      "action_statement": "Vulnerability CVE-2023-38286 affects version 2.7.16-tuxcare.6 of org.springframework.boot:spring-boot."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.7.16-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.7.16-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-22235 is fixed in version 2.7.16-tuxcare.6 of org.springframework.boot:spring-boot.",
      "vulnerability": {
        "name": "CVE-2025-22235"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.7.16-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.7.16-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40973 is fixed in version 2.7.16-tuxcare.6 of org.springframework.boot:spring-boot.",
      "vulnerability": {
        "name": "CVE-2026-40973"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.7.16-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.7.16-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40975 is fixed in version 2.7.16-tuxcare.6 of org.springframework.boot:spring-boot.",
      "vulnerability": {
        "name": "CVE-2026-40975"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.7.16-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.7.16-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-28T18:36:42.887038+00:00",
      "status_notes": "Vulnerability CVE-2026-40976 affects version 2.7.16-tuxcare.6 of org.springframework.boot:spring-boot.",
      "vulnerability": {
        "name": "CVE-2026-40976"
      },
      "action_statement": "Vulnerability CVE-2026-40976 affects version 2.7.16-tuxcare.6 of org.springframework.boot:spring-boot."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.7.16-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.7.16-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40977 is fixed in version 2.7.16-tuxcare.6 of org.springframework.boot:spring-boot.",
      "vulnerability": {
        "name": "CVE-2026-40977"
      }
    }
  ]
}