{
  "@id": "urn:uuid:b2486ccd-32b5-42f0-9c69-96442cc6fe8d",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 6,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:01:00.133094+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@3.1.6-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@3.1.6-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T09:25:00.043494+00:00",
      "status_notes": "Vulnerability CVE-2019-3799 does not affect version 3.1.6-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server. not_affected \u2014 CVE-2019-3799 directory traversal vulnerability is not present in Spring Cloud Config 3.1.6. The upstream fix (commit 3632fc6f64e567286c42c5a2f1b8142bfde505c2 by Spencer Gibb, April 2019) was already shipped in the upstream 3.1.6 release before TuxCare onboarded it. The target code contains path validation via PathUtils.isInvalidPath() and PathUtils.isInvalidEncodedPath() that reject directory ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3799"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-3799 directory traversal vulnerability is not present in Spring Cloud Config 3.1.6. The upstream fix (commit 3632fc6f64e567286c42c5a2f1b8142bfde505c2 by Spencer Gibb, April 2019) was already shipped in the upstream 3.1.6 release before TuxCare onboarded it. The target code contains path validation via PathUtils.isInvalidPath() and PathUtils.isInvalidEncodedPath() that reject directory ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@3.1.6-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@3.1.6-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T09:23:00.058016+00:00",
      "status_notes": "Vulnerability CVE-2020-5405 does not affect version 3.1.6-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server. not_affected \u2014 CVE-2020-5405 (directory traversal vulnerability) is NOT present in Spring Cloud Config 3.1.6-tuxcare.1. The upstream vendor (Spring team) fixed this vulnerability in commit 651f458919c40ef9a5e93e7d76bf98575910fad0 authored by Spencer Gibb on Feb 26, 2020. This fix was already present in the Spring Cloud Config 3.1.6 release that TuxCare onboarded (first TuxCare commit: 476c8a809e0b01a4d9be3959...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5405"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-5405 (directory traversal vulnerability) is NOT present in Spring Cloud Config 3.1.6-tuxcare.1. The upstream vendor (Spring team) fixed this vulnerability in commit 651f458919c40ef9a5e93e7d76bf98575910fad0 authored by Spencer Gibb on Feb 26, 2020. This fix was already present in the Spring Cloud Config 3.1.6 release that TuxCare onboarded (first TuxCare commit: 476c8a809e0b01a4d9be3959..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@3.1.6-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@3.1.6-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:01:00.133094+00:00",
      "status_notes": "Vulnerability CVE-2020-5410 does not affect version 3.1.6-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server. The target (spring-cloud-config 3.1.6-tuxcare.1) is not affected by CVE-2020-5410. Both upstream security patches that fix the directory traversal vulnerability are present in the codebase. The fixes were authored by the upstream vendor (spencer@gibb.us) and shipped in the upstream 3.1.6 release that TuxCare onboarded. All HTTP entry points (EnvironmentController, ResourceController) validate path components using PathUtils.isInvalidEncodedLocation() to reject \"..\" and \"#\" patterns, and GenericResourceRepository performs resource location verification via PathUtils.checkResource() to ensure resolved files remain within allowed directories.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.1.0, < 2.1.9; >= 2.2.0, < 2.2.3), NVD (>= 2.1.0, < 2.1.9; >= 2.2.0, < 2.2.3), cve.org (>= 2.1, < 2.1.9; >= 2.2, < 2.2.3), Snyk (>= 2.1.0, < 2.1.9; >= 2.2.0, < 2.2.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5410"
      },
      "impact_statement": "The target (spring-cloud-config 3.1.6-tuxcare.1) is not affected by CVE-2020-5410. Both upstream security patches that fix the directory traversal vulnerability are present in the codebase. The fixes were authored by the upstream vendor (spencer@gibb.us) and shipped in the upstream 3.1.6 release that TuxCare onboarded. All HTTP entry points (EnvironmentController, ResourceController) validate path components using PathUtils.isInvalidEncodedLocation() to reject \"..\" and \"#\" patterns, and GenericResourceRepository performs resource location verification via PathUtils.checkResource() to ensure resolved files remain within allowed directories.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.1.0, < 2.1.9; >= 2.2.0, < 2.2.3), NVD (>= 2.1.0, < 2.1.9; >= 2.2.0, < 2.2.3), cve.org (>= 2.1, < 2.1.9; >= 2.2, < 2.2.3), Snyk (>= 2.1.0, < 2.1.9; >= 2.2.0, < 2.2.3)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@3.1.6-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@3.1.6-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-22232 affects version 3.1.6-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server.",
      "vulnerability": {
        "name": "CVE-2025-22232"
      },
      "action_statement": "Vulnerability CVE-2025-22232 affects version 3.1.6-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@3.1.6-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@3.1.6-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-22739 affects version 3.1.6-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server.",
      "vulnerability": {
        "name": "CVE-2026-22739"
      },
      "action_statement": "Vulnerability CVE-2026-22739 affects version 3.1.6-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@3.1.6-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@3.1.6-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40981 affects version 3.1.6-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server.",
      "vulnerability": {
        "name": "CVE-2026-40981"
      },
      "action_statement": "Vulnerability CVE-2026-40981 affects version 3.1.6-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@3.1.6-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@3.1.6-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40982 is fixed in version 3.1.6-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server.",
      "vulnerability": {
        "name": "CVE-2026-40982"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@3.1.6-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@3.1.6-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41002 affects version 3.1.6-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server.",
      "vulnerability": {
        "name": "CVE-2026-41002"
      },
      "action_statement": "Vulnerability CVE-2026-41002 affects version 3.1.6-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@3.1.6-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@3.1.6-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41004 is fixed in version 3.1.6-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server.",
      "vulnerability": {
        "name": "CVE-2026-41004"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@3.1.6-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@3.1.6-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-47836 affects version 3.1.6-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server.",
      "vulnerability": {
        "name": "CVE-2026-47836"
      },
      "action_statement": "Vulnerability CVE-2026-47836 affects version 3.1.6-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@3.1.6-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@3.1.6-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-47837 affects version 3.1.6-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server.",
      "vulnerability": {
        "name": "CVE-2026-47837"
      },
      "action_statement": "Vulnerability CVE-2026-47837 affects version 3.1.6-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@3.1.6-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@3.1.6-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-47894 affects version 3.1.6-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server.",
      "vulnerability": {
        "name": "CVE-2026-47894"
      },
      "action_statement": "Vulnerability CVE-2026-47894 affects version 3.1.6-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server."
    }
  ]
}