{
  "@id": "urn:uuid:9314ed1b-044e-4b89-baa7-a66bd9f6cdd7",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T20:55:00.104909+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.7.7-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.7.7-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T14:27:43.708654+00:00",
      "status_notes": "Vulnerability CVE-2018-1196 does not affect version 2.7.7-tuxcare.2 of org.springframework.boot:spring-boot. not_affected \u2014 Spring Boot 2.7.7 is not affected by CVE-2018-1196. The symlink attack vulnerability was fixed in upstream Spring Boot commit 6ae960d295 (authored by pwebb@pivotal.io) and shipped in version 2.7.7 before TuxCare onboarded it. The vulnerable pattern (unconditional chown operations on PID_FOLDER and log_file) is not present; both chown operations are protected by existence checks that prevent fol...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1196"
      },
      "impact_statement": "not_affected \u2014 Spring Boot 2.7.7 is not affected by CVE-2018-1196. The symlink attack vulnerability was fixed in upstream Spring Boot commit 6ae960d295 (authored by pwebb@pivotal.io) and shipped in version 2.7.7 before TuxCare onboarded it. The vulnerable pattern (unconditional chown operations on PID_FOLDER and log_file) is not present; both chown operations are protected by existence checks that prevent fol..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.7.7-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.7.7-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T14:27:43.708654+00:00",
      "status_notes": "Vulnerability CVE-2022-27772 does not affect version 2.7.7-tuxcare.2 of org.springframework.boot:spring-boot. Spring Boot 2.7.7 is not affected by CVE-2022-27772. The vulnerable temporary directory creation pattern (File.createTempFile \u2192 delete \u2192 mkdir race condition) was fixed in upstream Spring Boot 2.2.11.RELEASE. The target version 2.7.7 shipped with these fixes already applied. Both AbstractConfigurableWebServerFactory.createTempDir() and ApplicationTemp now use the secure Files.createTempDirectory() API with proper permissions, eliminating the race condition that allowed local privilege escalation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.11.RELEASE), NVD (< 2.2.11), Snyk (< 2.2.11.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-27772"
      },
      "impact_statement": "Spring Boot 2.7.7 is not affected by CVE-2022-27772. The vulnerable temporary directory creation pattern (File.createTempFile \u2192 delete \u2192 mkdir race condition) was fixed in upstream Spring Boot 2.2.11.RELEASE. The target version 2.7.7 shipped with these fixes already applied. Both AbstractConfigurableWebServerFactory.createTempDir() and ApplicationTemp now use the secure Files.createTempDirectory() API with proper permissions, eliminating the race condition that allowed local privilege escalation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.11.RELEASE), NVD (< 2.2.11), Snyk (< 2.2.11.RELEASE)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.7.7-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.7.7-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T18:24:00.057353+00:00",
      "status_notes": "Vulnerability CVE-2025-22235 affects version 2.7.7-tuxcare.2 of org.springframework.boot:spring-boot, and is fixed in 2.7.7-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2025-22235"
      },
      "action_statement": "Vulnerability CVE-2025-22235 affects version 2.7.7-tuxcare.2 of org.springframework.boot:spring-boot, and is fixed in 2.7.7-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.7.7-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.7.7-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T14:27:43.708654+00:00",
      "status_notes": "Vulnerability CVE-2026-40973 affects version 2.7.7-tuxcare.2 of org.springframework.boot:spring-boot.",
      "vulnerability": {
        "name": "CVE-2026-40973"
      },
      "action_statement": "Vulnerability CVE-2026-40973 affects version 2.7.7-tuxcare.2 of org.springframework.boot:spring-boot."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.7.7-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.7.7-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T14:27:43.708654+00:00",
      "status_notes": "Vulnerability CVE-2026-40975 affects version 2.7.7-tuxcare.2 of org.springframework.boot:spring-boot.",
      "vulnerability": {
        "name": "CVE-2026-40975"
      },
      "action_statement": "Vulnerability CVE-2026-40975 affects version 2.7.7-tuxcare.2 of org.springframework.boot:spring-boot."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.7.7-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.7.7-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T20:55:00.104909+00:00",
      "status_notes": "Vulnerability CVE-2026-40976 does not affect version 2.7.7-tuxcare.2 of org.springframework.boot:spring-boot. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. The patch makes authentication unconditional by moving authorization outside the health-class presence check (patch:46). In this version, actuator-autoconfigure requires actuator, which contains `HealthEndpoint`; omitting the separate `spring-boot-health` artifact therefore does not remove that class (actuator-autoconfigure/build.gradle:30, HealthEndpoint.java:42). The management configuration applies to servlet applications using default security, whose condition checks security classes and missing custom security beans (ManagementWebSecurityAutoConfiguration.java:54, DefaultWebSecurityCondition.java:38). Its chain already permits health and unconditionally requires authentication for every other request before building the chain, so the vulnerable authorization-skipping branch is absent (ManagementWebSecurityAutoConfiguration.java:61).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-40976"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. The patch makes authentication unconditional by moving authorization outside the health-class presence check (patch:46). In this version, actuator-autoconfigure requires actuator, which contains `HealthEndpoint`; omitting the separate `spring-boot-health` artifact therefore does not remove that class (actuator-autoconfigure/build.gradle:30, HealthEndpoint.java:42). The management configuration applies to servlet applications using default security, whose condition checks security classes and missing custom security beans (ManagementWebSecurityAutoConfiguration.java:54, DefaultWebSecurityCondition.java:38). Its chain already permits health and unconditionally requires authentication for every other request before building the chain, so the vulnerable authorization-skipping branch is absent (ManagementWebSecurityAutoConfiguration.java:61)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.7.7-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.7.7-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T14:27:43.708654+00:00",
      "status_notes": "Vulnerability CVE-2026-40977 affects version 2.7.7-tuxcare.2 of org.springframework.boot:spring-boot.",
      "vulnerability": {
        "name": "CVE-2026-40977"
      },
      "action_statement": "Vulnerability CVE-2026-40977 affects version 2.7.7-tuxcare.2 of org.springframework.boot:spring-boot."
    }
  ]
}