{
  "@id": "urn:uuid:d64679e7-5227-4126-b40d-31c903ca76a0",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 13,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T20:55:00.104909+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@3.1.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@3.1.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2018-1196 does not affect version 3.1.8-tuxcare.7 of org.springframework.boot:spring-boot. not_affected \u2014 CVE-2018-1196 symlink attack vulnerability is not present in the target. The fix was already included in the upstream Spring Boot 3.1.8 release that TuxCare onboarded. The vulnerable code pattern (unconditional chown on PID/log files/folders) has been replaced with defensive checks that only change ownership of newly-created filesystem objects, preventing symlink attacks that could lead to arbi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1196"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1196 symlink attack vulnerability is not present in the target. The fix was already included in the upstream Spring Boot 3.1.8 release that TuxCare onboarded. The vulnerable code pattern (unconditional chown on PID/log files/folders) has been replaced with defensive checks that only change ownership of newly-created filesystem objects, preventing symlink attacks that could lead to arbi..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@3.1.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@3.1.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2022-27772 does not affect version 3.1.8-tuxcare.7 of org.springframework.boot:spring-boot. CVE-2022-27772 (temp directory hijacking via createTempFile->delete->mkdir race) affects Spring Boot versions < 2.2.11.RELEASE. The target version 3.1.8 contains the upstream fix from commit 667ccdae84 (authored by Andy Wilkinson, awilkinson@pivotal.io) which replaced the vulnerable pattern with atomic Files.createTempDirectory(). This fix was already present in the upstream Spring Boot 3.1.8 release when TuxCare onboarded it (commit 81e305e085). The vulnerable code pattern is absent from the target; all web server implementations (Tomcat, Jetty, Undertow) inherit the fixed createTempDir method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.11.RELEASE), NVD (< 2.2.11), Snyk (< 2.2.11.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-27772"
      },
      "impact_statement": "CVE-2022-27772 (temp directory hijacking via createTempFile->delete->mkdir race) affects Spring Boot versions < 2.2.11.RELEASE. The target version 3.1.8 contains the upstream fix from commit 667ccdae84 (authored by Andy Wilkinson, awilkinson@pivotal.io) which replaced the vulnerable pattern with atomic Files.createTempDirectory(). This fix was already present in the upstream Spring Boot 3.1.8 release when TuxCare onboarded it (commit 81e305e085). The vulnerable code pattern is absent from the target; all web server implementations (Tomcat, Jetty, Undertow) inherit the fixed createTempDir method.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.11.RELEASE), NVD (< 2.2.11), Snyk (< 2.2.11.RELEASE)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@3.1.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@3.1.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-22235 is fixed in version 3.1.8-tuxcare.7 of org.springframework.boot:spring-boot.",
      "vulnerability": {
        "name": "CVE-2025-22235"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@3.1.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@3.1.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-28T18:36:42.887038+00:00",
      "status_notes": "Vulnerability CVE-2026-40973 affects version 3.1.8-tuxcare.7 of org.springframework.boot:spring-boot.",
      "vulnerability": {
        "name": "CVE-2026-40973"
      },
      "action_statement": "Vulnerability CVE-2026-40973 affects version 3.1.8-tuxcare.7 of org.springframework.boot:spring-boot."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@3.1.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@3.1.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-13T17:18:00.098046+00:00",
      "status_notes": "Vulnerability CVE-2026-40975 affects version 3.1.8-tuxcare.7 of org.springframework.boot:spring-boot.",
      "vulnerability": {
        "name": "CVE-2026-40975"
      },
      "action_statement": "Vulnerability CVE-2026-40975 affects version 3.1.8-tuxcare.7 of org.springframework.boot:spring-boot."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@3.1.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@3.1.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-09T20:55:00.104909+00:00",
      "status_notes": "Vulnerability CVE-2026-40976 does not affect version 3.1.8-tuxcare.7 of org.springframework.boot:spring-boot. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. Actuator autoconfiguration requires `spring-boot-actuator` through an API dependency (build.gradle:21), and that module contains HealthEndpoint.java:42. The servlet management configuration uses the default-security condition, which checks security classes and the absence of a user filter chain, without a health-class condition (ManagementWebSecurityAutoConfiguration.java:55; DefaultWebSecurityCondition.java:38). Its chain permits the health matcher and unconditionally applies `anyRequest().authenticated()` before building the chain (ManagementWebSecurityAutoConfiguration.java:62). The supplied servlet patch moves authentication outside a health-presence guard that previously enclosed all authorization configuration (01-874f6294b91d.patch:46).",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-40976"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. Actuator autoconfiguration requires `spring-boot-actuator` through an API dependency (build.gradle:21), and that module contains HealthEndpoint.java:42. The servlet management configuration uses the default-security condition, which checks security classes and the absence of a user filter chain, without a health-class condition (ManagementWebSecurityAutoConfiguration.java:55; DefaultWebSecurityCondition.java:38). Its chain permits the health matcher and unconditionally applies `anyRequest().authenticated()` before building the chain (ManagementWebSecurityAutoConfiguration.java:62). The supplied servlet patch moves authentication outside a health-presence guard that previously enclosed all authorization configuration (01-874f6294b91d.patch:46)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@3.1.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@3.1.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-13T17:18:00.098046+00:00",
      "status_notes": "Vulnerability CVE-2026-40977 affects version 3.1.8-tuxcare.7 of org.springframework.boot:spring-boot.",
      "vulnerability": {
        "name": "CVE-2026-40977"
      },
      "action_statement": "Vulnerability CVE-2026-40977 affects version 3.1.8-tuxcare.7 of org.springframework.boot:spring-boot."
    }
  ]
}