{
  "@id": "urn:uuid:66ac5fa5-3c02-4db4-9aaf-d0cd05259fcf",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T19:21:00.033487+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.7.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.7.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T15:19:35.082848+00:00",
      "status_notes": "Vulnerability CVE-2018-1196 does not affect version 2.7.8-tuxcare.2 of org.springframework.boot:spring-boot. not_affected \u2014 Spring Boot 2.7.8 (target SHA 4fa05f46fd) is not affected by CVE-2018-1196. The symlink attack vulnerability in the embedded launch script was fixed by upstream Spring Boot commits 6ae960d295 and d59000ceb1, both of which were already present in the Spring Boot 2.7.8 release before TuxCare onboarded it. The vulnerable code pattern (unconditional chown of potentially-symlinked paths) is not pres...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1196"
      },
      "impact_statement": "not_affected \u2014 Spring Boot 2.7.8 (target SHA 4fa05f46fd) is not affected by CVE-2018-1196. The symlink attack vulnerability in the embedded launch script was fixed by upstream Spring Boot commits 6ae960d295 and d59000ceb1, both of which were already present in the Spring Boot 2.7.8 release before TuxCare onboarded it. The vulnerable code pattern (unconditional chown of potentially-symlinked paths) is not pres..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.7.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.7.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T15:19:35.082848+00:00",
      "status_notes": "Vulnerability CVE-2022-27772 does not affect version 2.7.8-tuxcare.2 of org.springframework.boot:spring-boot. CVE-2022-27772 affects Spring Boot versions prior to v2.2.11.RELEASE due to a race condition in temporary directory creation. The vulnerable pattern (File.createTempFile \u2192 delete \u2192 mkdir) allowed local attackers to hijack the application's working directory. The target (Spring Boot 2.7.8, SHA 4fa05f46fd) is NOT affected because the upstream fix (commit 667ccdae by Andy Wilkinson, 2020-10-13) was already included in the Spring Boot 2.7.8 release (2023-01-19) that TuxCare onboarded. All affected files now use the secure Files.createTempDirectory() API, which creates directories atomically without a race window. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.11.RELEASE), NVD (< 2.2.11), Snyk (< 2.2.11.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-27772"
      },
      "impact_statement": "CVE-2022-27772 affects Spring Boot versions prior to v2.2.11.RELEASE due to a race condition in temporary directory creation. The vulnerable pattern (File.createTempFile \u2192 delete \u2192 mkdir) allowed local attackers to hijack the application's working directory. The target (Spring Boot 2.7.8, SHA 4fa05f46fd) is NOT affected because the upstream fix (commit 667ccdae by Andy Wilkinson, 2020-10-13) was already included in the Spring Boot 2.7.8 release (2023-01-19) that TuxCare onboarded. All affected files now use the secure Files.createTempDirectory() API, which creates directories atomically without a race window. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.11.RELEASE), NVD (< 2.2.11), Snyk (< 2.2.11.RELEASE)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.7.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.7.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T19:21:00.033487+00:00",
      "status_notes": "Vulnerability CVE-2025-22235 affects version 2.7.8-tuxcare.2 of org.springframework.boot:spring-boot, and is fixed in 2.7.8-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2025-22235"
      },
      "action_statement": "Vulnerability CVE-2025-22235 affects version 2.7.8-tuxcare.2 of org.springframework.boot:spring-boot, and is fixed in 2.7.8-tuxcare.3."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.7.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.7.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T15:20:03.369617+00:00",
      "status_notes": "Vulnerability CVE-2026-40973 is fixed in version 2.7.8-tuxcare.2 of org.springframework.boot:spring-boot.",
      "vulnerability": {
        "name": "CVE-2026-40973"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.7.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.7.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T15:19:35.082848+00:00",
      "status_notes": "Vulnerability CVE-2026-40975 affects version 2.7.8-tuxcare.2 of org.springframework.boot:spring-boot.",
      "vulnerability": {
        "name": "CVE-2026-40975"
      },
      "action_statement": "Vulnerability CVE-2026-40975 affects version 2.7.8-tuxcare.2 of org.springframework.boot:spring-boot."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.7.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.7.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T15:19:35.082848+00:00",
      "status_notes": "Vulnerability CVE-2026-40976 affects version 2.7.8-tuxcare.2 of org.springframework.boot:spring-boot.",
      "vulnerability": {
        "name": "CVE-2026-40976"
      },
      "action_statement": "Vulnerability CVE-2026-40976 affects version 2.7.8-tuxcare.2 of org.springframework.boot:spring-boot."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.7.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.7.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T15:19:35.082848+00:00",
      "status_notes": "Vulnerability CVE-2026-40977 affects version 2.7.8-tuxcare.2 of org.springframework.boot:spring-boot.",
      "vulnerability": {
        "name": "CVE-2026-40977"
      },
      "action_statement": "Vulnerability CVE-2026-40977 affects version 2.7.8-tuxcare.2 of org.springframework.boot:spring-boot."
    }
  ]
}