{
  "@id": "urn:uuid:51d17304-52fa-4398-8ec4-663ade14051d",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 21,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T04:13:00.045658+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@3.5.16-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@3.5.16-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2018-1196 does not affect version 3.5.16-tuxcare.8 of org.springframework.boot:spring-boot. not_affected \u2014 CVE-2018-1196 symlink attack vulnerability is NOT present in Spring Boot 3.5.16. The upstream fixes (commits 6ae960d295 and d59000ceb1) that prevent unconditional chown operations on potentially attacker-controlled symlinks were already included in the upstream Spring Boot 3.5.16 release before TuxCare onboarded it. The target repository's launch.script correctly checks for file/folder existenc...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1196"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1196 symlink attack vulnerability is NOT present in Spring Boot 3.5.16. The upstream fixes (commits 6ae960d295 and d59000ceb1) that prevent unconditional chown operations on potentially attacker-controlled symlinks were already included in the upstream Spring Boot 3.5.16 release before TuxCare onboarded it. The target repository's launch.script correctly checks for file/folder existenc..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@3.5.16-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@3.5.16-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2022-27772 does not affect version 3.5.16-tuxcare.8 of org.springframework.boot:spring-boot. The target (Spring Boot 3.5.16-tuxcare.9) is not affected by CVE-2022-27772. The vulnerable temp directory creation pattern (File.createTempFile + delete + mkdir) was removed by upstream commit 667ccdae84 in October 2020, years before TuxCare onboarded version 3.5.16 in July 2026. The fix uses Files.createTempDirectory() for atomic, race-free directory creation. No TuxCare backport was needed for this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.11.RELEASE), NVD (< 2.2.11), Snyk (< 2.2.11.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-27772"
      },
      "impact_statement": "The target (Spring Boot 3.5.16-tuxcare.9) is not affected by CVE-2022-27772. The vulnerable temp directory creation pattern (File.createTempFile + delete + mkdir) was removed by upstream commit 667ccdae84 in October 2020, years before TuxCare onboarded version 3.5.16 in July 2026. The fix uses Files.createTempDirectory() for atomic, race-free directory creation. No TuxCare backport was needed for this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.11.RELEASE), NVD (< 2.2.11), Snyk (< 2.2.11.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@3.5.16-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@3.5.16-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-06T17:24:21.599166+00:00",
      "status_notes": "Vulnerability CVE-2025-22235 does not affect version 3.5.16-tuxcare.8 of org.springframework.boot:spring-boot. Prechecker: The upstream fix is already in this version's source history (commit 55f67c9a). Version 3.5.16 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-rc42-6c7j-7h5r (affected up to 3.4.5), CVE record (affected up to 3.4.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22235"
      },
      "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commit 55f67c9a). Version 3.5.16 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-rc42-6c7j-7h5r (affected up to 3.4.5), CVE record (affected up to 3.4.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@3.5.16-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@3.5.16-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-03T11:40:52.629939+00:00",
      "status_notes": "Vulnerability CVE-2026-40973 does not affect version 3.5.16-tuxcare.8 of org.springframework.boot:spring-boot. CVE-2026-40973 addresses a vulnerability where a local attacker could take control of ApplicationTemp's temporary directory, potentially enabling session hijacking or code execution. The upstream fix by Andy Wilkinson (commit 5ceb1a228932e35cc803d1c1fea68f0f984aaa90) was already included in Spring Boot 3.5.16. TuxCare onboarded version 3.5.16 at commit 63072687e, which is 202 commits after the fix. The target at SHA 0a95894a49 (spring-boot 3.5.16-tuxcare.8) contains all security protections: ownership validation via UserPrincipal, NOFOLLOW_LINKS to prevent symlink attacks, permission checks, and directory type validation. The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.0.6; >= 3.5.0, < 3.5.14; >= 3.4.0, <= 3.4.15; >= 3.3.0, <= 3.3.18; <= 2.7.32), NVD (< 2.7.33; >= 3.3.0, < 3.3.19; >= 3.4.0, < 3.4.16; >= 3.5.0, < 3.5.14; >= 4.0.0, < 4.0.6), cve.org (>= 4.0.0, < 4.0.6; >= 3.5.0, < 3.5.14; >= 3.4.0, < 3.4.16; >= 3.3.0, < 3.3.19; >= 2.7.0, < 2.7.33), Snyk (< 3.5.14; >= 4.0.0-M1, < 4.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-40973"
      },
      "impact_statement": "CVE-2026-40973 addresses a vulnerability where a local attacker could take control of ApplicationTemp's temporary directory, potentially enabling session hijacking or code execution. The upstream fix by Andy Wilkinson (commit 5ceb1a228932e35cc803d1c1fea68f0f984aaa90) was already included in Spring Boot 3.5.16. TuxCare onboarded version 3.5.16 at commit 63072687e, which is 202 commits after the fix. The target at SHA 0a95894a49 (spring-boot 3.5.16-tuxcare.8) contains all security protections: ownership validation via UserPrincipal, NOFOLLOW_LINKS to prevent symlink attacks, permission checks, and directory type validation. The vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.0.6; >= 3.5.0, < 3.5.14; >= 3.4.0, <= 3.4.15; >= 3.3.0, <= 3.3.18; <= 2.7.32), NVD (< 2.7.33; >= 3.3.0, < 3.3.19; >= 3.4.0, < 3.4.16; >= 3.5.0, < 3.5.14; >= 4.0.0, < 4.0.6), cve.org (>= 4.0.0, < 4.0.6; >= 3.5.0, < 3.5.14; >= 3.4.0, < 3.4.16; >= 3.3.0, < 3.3.19; >= 2.7.0, < 2.7.33), Snyk (< 3.5.14; >= 4.0.0-M1, < 4.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@3.5.16-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@3.5.16-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-29T06:32:14.253219+00:00",
      "status_notes": "Vulnerability CVE-2026-40975 does not affect version 3.5.16-tuxcare.8 of org.springframework.boot:spring-boot. not_affected \u2014 The target repository version 3.5.16-tuxcare.8 is NOT affected by CVE-2026-40975. The vulnerability concerns weak random number generation in Spring Boot's RandomValuePropertySource class, which historically used java.util.Random instead of java.security.SecureRandom for ${random.*} configuration placeholders. The fix (replacing Random with SecureRandom) was already present in upstream Spring B...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-40975"
      },
      "impact_statement": "not_affected \u2014 The target repository version 3.5.16-tuxcare.8 is NOT affected by CVE-2026-40975. The vulnerability concerns weak random number generation in Spring Boot's RandomValuePropertySource class, which historically used java.util.Random instead of java.security.SecureRandom for ${random.*} configuration placeholders. The fix (replacing Random with SecureRandom) was already present in upstream Spring B..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@3.5.16-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@3.5.16-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-10T04:13:00.045658+00:00",
      "status_notes": "Vulnerability CVE-2026-40976 does not affect version 3.5.16-tuxcare.8 of org.springframework.boot:spring-boot. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because its management security chain requires authentication for every request except health checks, without a condition on whether the health class is present. The unconditional authentication rule is in spring-boot-project/spring-boot-actuator-autoconfigure/src/main/java/org/springframework/boot/actuate/autoconfigure/security/servlet/ManagementWebSecurityAutoConfiguration.java:66.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-40976"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because its management security chain requires authentication for every request except health checks, without a condition on whether the health class is present. The unconditional authentication rule is in spring-boot-project/spring-boot-actuator-autoconfigure/src/main/java/org/springframework/boot/actuate/autoconfigure/security/servlet/ManagementWebSecurityAutoConfiguration.java:66."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@3.5.16-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@3.5.16-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-29T06:08:36.782808+00:00",
      "status_notes": "Vulnerability CVE-2026-40977 does not affect version 3.5.16-tuxcare.8 of org.springframework.boot:spring-boot. not_affected \u2014 CVE-2026-40977 is not present in Spring Boot 3.5.16-tuxcare.8. The vulnerability, which allowed local attackers to corrupt arbitrary files via symlink attacks when ApplicationPidFileWriter is configured, was fixed in the upstream Spring Boot 3.5.16 release before TuxCare onboarded it. The fix (commit f533a4549c by Andy Wilkinson from Broadcom) added LinkOption.NOFOLLOW_LINKS to prevent symlink ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-40977"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-40977 is not present in Spring Boot 3.5.16-tuxcare.8. The vulnerability, which allowed local attackers to corrupt arbitrary files via symlink attacks when ApplicationPidFileWriter is configured, was fixed in the upstream Spring Boot 3.5.16 release before TuxCare onboarded it. The fix (commit f533a4549c by Andy Wilkinson from Broadcom) added LinkOption.NOFOLLOW_LINKS to prevent symlink ..."
    }
  ]
}