{
  "@id": "urn:uuid:39b96935-4fcb-4f48-a0f1-3e414ba48e37",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T12:26:24.038325+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-cloudfoundry-connector@1.2.9.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-cloudfoundry-connector@1.2.9.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T12:26:24.038325+00:00",
      "status_notes": "Vulnerability CVE-2016-3084 is a false positive for org.springframework.cloud:spring-cloud-cloudfoundry-connector 1.2.9.RELEASE-tuxcare.1. CVE-2016-3084 concerns the UAA (User Account and Authentication) service's password reset flow vulnerability. This repository is Spring Cloud Connectors v1.2.9.RELEASE, a client library for discovering and connecting to Cloud Foundry services (databases, Redis, AMQP, etc.). These are completely different products. The UAA authentication service code, including password reset flows, is entirely absent from this repository. This is a wrong-project match.",
      "vulnerability": {
        "name": "CVE-2016-3084"
      },
      "impact_statement": "CVE-2016-3084 concerns the UAA (User Account and Authentication) service's password reset flow vulnerability. This repository is Spring Cloud Connectors v1.2.9.RELEASE, a client library for discovering and connecting to Cloud Foundry services (databases, Redis, AMQP, etc.). These are completely different products. The UAA authentication service code, including password reset flows, is entirely absent from this repository. This is a wrong-project match."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-cloudfoundry-connector@1.2.9.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-cloudfoundry-connector@1.2.9.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T12:26:24.038325+00:00",
      "status_notes": "Vulnerability CVE-2016-4468 is a false positive for org.springframework.cloud:spring-cloud-cloudfoundry-connector 1.2.9.RELEASE-tuxcare.1. CVE-2016-4468 is a wrong-project match. The CVE explicitly concerns UAA (User Account and Authentication service, versions 2.x/3.x/3.4.x) and describes SQL injection in UAA's authentication backend. The target repository is spring-cloud-connectors v1.2.9.RELEASE, a library for connecting applications to cloud services. Exhaustive containment search confirms: (1) spring-cloud-connectors is NOT UAA; (2) no vendored/bundled copy of UAA code exists in the repo; (3) no UAA dependency declarations found in gradle files. The provided patches address JDBC URL credential encoding in spring-cloud-connectors, unrelated to UAA's SQL injection vulnerability. Product identity evidence: gradle.properties (org.springframework.cloud, version 1.2.9.RELEASE), README.adoc (\"Spring Cloud Connectors provides abstraction...to connect to services\").",
      "vulnerability": {
        "name": "CVE-2016-4468"
      },
      "impact_statement": "CVE-2016-4468 is a wrong-project match. The CVE explicitly concerns UAA (User Account and Authentication service, versions 2.x/3.x/3.4.x) and describes SQL injection in UAA's authentication backend. The target repository is spring-cloud-connectors v1.2.9.RELEASE, a library for connecting applications to cloud services. Exhaustive containment search confirms: (1) spring-cloud-connectors is NOT UAA; (2) no vendored/bundled copy of UAA code exists in the repo; (3) no UAA dependency declarations found in gradle files. The provided patches address JDBC URL credential encoding in spring-cloud-connectors, unrelated to UAA's SQL injection vulnerability. Product identity evidence: gradle.properties (org.springframework.cloud, version 1.2.9.RELEASE), README.adoc (\"Spring Cloud Connectors provides abstraction...to connect to services\")."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-cloudfoundry-connector@1.2.9.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-cloudfoundry-connector@1.2.9.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T12:26:24.038325+00:00",
      "status_notes": "Vulnerability CVE-2016-5006 does not affect version 1.2.9.RELEASE-tuxcare.1 of org.springframework.cloud:spring-cloud-cloudfoundry-connector. not_affected \u2014 Target is spring-cloud-connectors 1.2.9.RELEASE \u2014 the same project the patch modifies (product-identity match, not a false positive despite the CVE text naming CF Cloud Controller). The vendor patch (commit 7cf18cce, \"add getScheme() and a useful toString()\") adds a credential-masking toString() to UriBasedServiceInfo that renders the service URI with the password replaced by the literal \"****\", plus a getScheme() accessor supporting it. The Attack Vector Goal is: the password appearing in the human-readable string/log representation of a service-info object; the patch's Defense is the masking toString().\n\nThe target's spring-cloud-core/.../service/UriBasedServiceInfo.java at HEAD already contains this exact defense: getScheme() is present, and the toString() override masks the password as \":****@\" (lines ~74-76 and ~98-105 of HEAD's version of the file). git confirms the patch commit 7cf18cce IS an ancestor of HEAD and an ancestor of the upstream onboard baseline 5c5ba52. The fix is therefore an upstream commit (author chrylis@gmail.com, 2014) baked into the onboarded 1.2.9.RELEASE, not something TuxCare backported.\n\nBecause the vendor's fix is present in HEAD via an upstream (non-TuxCare) commit, the pre-fix vulnerable pattern (a UriBasedServiceInfo lacking the masking toString) is not present. Verdict: not_affected (upstream-fix-already-present), justification code_not_present. This is not already_fixed because the fix was not authored/backported by CloudLinux/TuxCare \u2014 it predates TuxCare involvement entirely. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5006"
      },
      "impact_statement": "not_affected \u2014 Target is spring-cloud-connectors 1.2.9.RELEASE \u2014 the same project the patch modifies (product-identity match, not a false positive despite the CVE text naming CF Cloud Controller). The vendor patch (commit 7cf18cce, \"add getScheme() and a useful toString()\") adds a credential-masking toString() to UriBasedServiceInfo that renders the service URI with the password replaced by the literal \"****\", plus a getScheme() accessor supporting it. The Attack Vector Goal is: the password appearing in the human-readable string/log representation of a service-info object; the patch's Defense is the masking toString().\n\nThe target's spring-cloud-core/.../service/UriBasedServiceInfo.java at HEAD already contains this exact defense: getScheme() is present, and the toString() override masks the password as \":****@\" (lines ~74-76 and ~98-105 of HEAD's version of the file). git confirms the patch commit 7cf18cce IS an ancestor of HEAD and an ancestor of the upstream onboard baseline 5c5ba52. The fix is therefore an upstream commit (author chrylis@gmail.com, 2014) baked into the onboarded 1.2.9.RELEASE, not something TuxCare backported.\n\nBecause the vendor's fix is present in HEAD via an upstream (non-TuxCare) commit, the pre-fix vulnerable pattern (a UriBasedServiceInfo lacking the masking toString) is not present. Verdict: not_affected (upstream-fix-already-present), justification code_not_present. This is not already_fixed because the fix was not authored/backported by CloudLinux/TuxCare \u2014 it predates TuxCare involvement entirely. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-cloudfoundry-connector@1.2.9.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-cloudfoundry-connector@1.2.9.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T12:26:24.038325+00:00",
      "status_notes": "Vulnerability CVE-2016-5016 does not affect version 1.2.9.RELEASE-tuxcare.1 of org.springframework.cloud:spring-cloud-cloudfoundry-connector. not_affected \u2014 Spring Cloud Connectors 1.2.9.RELEASE is not affected by CVE-2016-5016. This library reads environment variables to discover Cloud Foundry service bindings but does not handle X.509 certificates, perform TLS/SSL connections, or validate certificates. The vulnerability concerns missing certificate expiration validation in UAA, but this library has no certificate validation code at all. The INPUT...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-5016"
      },
      "impact_statement": "not_affected \u2014 Spring Cloud Connectors 1.2.9.RELEASE is not affected by CVE-2016-5016. This library reads environment variables to discover Cloud Foundry service bindings but does not handle X.509 certificates, perform TLS/SSL connections, or validate certificates. The vulnerability concerns missing certificate expiration validation in UAA, but this library has no certificate validation code at all. The INPUT..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-cloudfoundry-connector@1.2.9.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-cloudfoundry-connector@1.2.9.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T12:26:24.038325+00:00",
      "status_notes": "Vulnerability CVE-2016-6636 is a false positive for org.springframework.cloud:spring-cloud-cloudfoundry-connector 1.2.9.RELEASE-tuxcare.1. false_positive \u2014 CVE-2016-6636 is a false positive match for Spring Cloud Connectors 1.2.9.RELEASE. The CVE affects UAA (User Account and Authentication) OAuth authorization server, while the target repository is Spring Cloud Connectors - a client library for service discovery and connection on Cloud Foundry. These are completely separate projects with different purposes. The affected OAuth authorization code i...",
      "vulnerability": {
        "name": "CVE-2016-6636"
      },
      "impact_statement": "false_positive \u2014 CVE-2016-6636 is a false positive match for Spring Cloud Connectors 1.2.9.RELEASE. The CVE affects UAA (User Account and Authentication) OAuth authorization server, while the target repository is Spring Cloud Connectors - a client library for service discovery and connection on Cloud Foundry. These are completely separate projects with different purposes. The affected OAuth authorization code i..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-cloudfoundry-connector@1.2.9.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-cloudfoundry-connector@1.2.9.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T12:26:24.038325+00:00",
      "status_notes": "Vulnerability CVE-2016-6637 is a false positive for org.springframework.cloud:spring-cloud-cloudfoundry-connector 1.2.9.RELEASE-tuxcare.1. CVE-2016-6637 is a CSRF vulnerability affecting the UAA (User Account and Authentication) OAuth2 authorization server in Pivotal Cloud Foundry, specifically in scope approval/denial endpoints. However, the target repository is Spring Cloud Connectors v1.2.9.RELEASE, which is a completely different component - a client-side library that helps Spring applications discover and connect to backing services when running on Cloud Foundry. This is a wrong-project match. The UAA authorization server code is not present anywhere in this repository.",
      "vulnerability": {
        "name": "CVE-2016-6637"
      },
      "impact_statement": "CVE-2016-6637 is a CSRF vulnerability affecting the UAA (User Account and Authentication) OAuth2 authorization server in Pivotal Cloud Foundry, specifically in scope approval/denial endpoints. However, the target repository is Spring Cloud Connectors v1.2.9.RELEASE, which is a completely different component - a client-side library that helps Spring applications discover and connect to backing services when running on Cloud Foundry. This is a wrong-project match. The UAA authorization server code is not present anywhere in this repository."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-cloudfoundry-connector@1.2.9.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-cloudfoundry-connector@1.2.9.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T12:26:24.038325+00:00",
      "status_notes": "Vulnerability CVE-2016-6651 is a false positive for org.springframework.cloud:spring-cloud-cloudfoundry-connector 1.2.9.RELEASE-tuxcare.1. CVE-2016-6651 is a false positive for Spring Cloud Connectors 1.2.9.RELEASE. The CVE affects the UAA (User Account and Authentication) service's /oauth/token endpoint in Pivotal Cloud Foundry, which is a completely separate authentication/authorization server. Spring Cloud Connectors is a service discovery library that helps applications discover and connect to cloud services via environment variables (VCAP_SERVICES, VCAP_APPLICATION). It does not implement OAuth token handling, authentication endpoints, or any UAA functionality. Exhaustive search confirmed no UAA code exists in the repository as the project itself, as vendored/bundled code, or as a declared dependency.",
      "vulnerability": {
        "name": "CVE-2016-6651"
      },
      "impact_statement": "CVE-2016-6651 is a false positive for Spring Cloud Connectors 1.2.9.RELEASE. The CVE affects the UAA (User Account and Authentication) service's /oauth/token endpoint in Pivotal Cloud Foundry, which is a completely separate authentication/authorization server. Spring Cloud Connectors is a service discovery library that helps applications discover and connect to cloud services via environment variables (VCAP_SERVICES, VCAP_APPLICATION). It does not implement OAuth token handling, authentication endpoints, or any UAA functionality. Exhaustive search confirmed no UAA code exists in the repository as the project itself, as vendored/bundled code, or as a declared dependency."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-cloudfoundry-connector@1.2.9.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-cloudfoundry-connector@1.2.9.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T12:26:24.038325+00:00",
      "status_notes": "Vulnerability CVE-2016-6659 is a false positive for org.springframework.cloud:spring-cloud-cloudfoundry-connector 1.2.9.RELEASE-tuxcare.1. CVE-2016-6659 affects Cloud Foundry UAA (User Account and Authentication), an OAuth2/SAML authentication server. This repository is Spring Cloud Connectors v1.2.9.RELEASE, a service discovery client library for Cloud Foundry applications. Product-Identity Check confirms wrong-project match: (a) This repo provides service discovery/connection abstractions for backing services (databases, message queues); (b) CVE targets UAA authentication server; (c) Exhaustive containment search found NO UAA code (not as project, not vendored, not dependency). The affected component is completely absent from this repository.",
      "vulnerability": {
        "name": "CVE-2016-6659"
      },
      "impact_statement": "CVE-2016-6659 affects Cloud Foundry UAA (User Account and Authentication), an OAuth2/SAML authentication server. This repository is Spring Cloud Connectors v1.2.9.RELEASE, a service discovery client library for Cloud Foundry applications. Product-Identity Check confirms wrong-project match: (a) This repo provides service discovery/connection abstractions for backing services (databases, message queues); (b) CVE targets UAA authentication server; (c) Exhaustive containment search found NO UAA code (not as project, not vendored, not dependency). The affected component is completely absent from this repository."
    }
  ]
}