{
  "@id": "urn:uuid:17c4b92d-7b32-42ad-8490-bf5d82e498c1",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:02:00.202619+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@4.2.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@4.2.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T09:25:00.043494+00:00",
      "status_notes": "Vulnerability CVE-2019-3799 does not affect version 4.2.4-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server. not_affected \u2014 CVE-2019-3799 directory traversal vulnerability is NOT present in spring-cloud-config 4.2.4-tuxcare.1. The upstream fix (commit 3632fc6f) was already included in version 4.2.4 when TuxCare onboarded it. The fix adds comprehensive path validation through PathUtils.isInvalidPath() and PathUtils.isInvalidEncodedPath() methods, which are applied at both the HTTP controller level (ResourceController...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3799"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-3799 directory traversal vulnerability is NOT present in spring-cloud-config 4.2.4-tuxcare.1. The upstream fix (commit 3632fc6f) was already included in version 4.2.4 when TuxCare onboarded it. The fix adds comprehensive path validation through PathUtils.isInvalidPath() and PathUtils.isInvalidEncodedPath() methods, which are applied at both the HTTP controller level (ResourceController..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@4.2.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@4.2.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T09:25:00.043494+00:00",
      "status_notes": "Vulnerability CVE-2020-5405 does not affect version 4.2.4-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server. not_affected \u2014 CVE-2020-5405 directory traversal vulnerability is not present in Spring Cloud Config 4.2.4-tuxcare.1. The fix was already included in the upstream 4.2.4 release, introduced by commit 651f458919c40ef9a5e93e7d76bf98575910fad0 authored by Spencer Gibb on Feb 26, 2020. The target implements comprehensive defenses: PathUtils.isInvalidEncodedLocation() URL-decodes and rejects parameters containing \"...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5405"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-5405 directory traversal vulnerability is not present in Spring Cloud Config 4.2.4-tuxcare.1. The fix was already included in the upstream 4.2.4 release, introduced by commit 651f458919c40ef9a5e93e7d76bf98575910fad0 authored by Spencer Gibb on Feb 26, 2020. The target implements comprehensive defenses: PathUtils.isInvalidEncodedLocation() URL-decodes and rejects parameters containing \"..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@4.2.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@4.2.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:02:00.202619+00:00",
      "status_notes": "Vulnerability CVE-2020-5410 does not affect version 4.2.4-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server. CVE-2020-5410 describes a directory traversal vulnerability allowing attackers to serve arbitrary configuration files through specially crafted URLs. The target repository (spring-cloud-config 4.2.4-tuxcare.1) is NOT AFFECTED because the upstream vendor (Spring/Broadcom) already fixed this vulnerability in the 4.2.4 release that TuxCare onboarded. Both required patches (commits 1c01d11b and f470b52f by Spencer Gibb) are present in HEAD and were applied before TuxCare's onboarding commit (38d3fb49). The complete defense includes: (1) EnvironmentController validates name/label parameters via PathUtils.isInvalidEncodedLocation() rejecting \"..\" and \"#\", (2) GenericResourceRepository verifies resolved resources remain within allowed locations via PathUtils.checkResource(). The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.1.0, < 2.1.9; >= 2.2.0, < 2.2.3), NVD (>= 2.1.0, < 2.1.9; >= 2.2.0, < 2.2.3), cve.org (>= 2.1, < 2.1.9; >= 2.2, < 2.2.3), Snyk (>= 2.1.0, < 2.1.9; >= 2.2.0, < 2.2.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5410"
      },
      "impact_statement": "CVE-2020-5410 describes a directory traversal vulnerability allowing attackers to serve arbitrary configuration files through specially crafted URLs. The target repository (spring-cloud-config 4.2.4-tuxcare.1) is NOT AFFECTED because the upstream vendor (Spring/Broadcom) already fixed this vulnerability in the 4.2.4 release that TuxCare onboarded. Both required patches (commits 1c01d11b and f470b52f by Spencer Gibb) are present in HEAD and were applied before TuxCare's onboarding commit (38d3fb49). The complete defense includes: (1) EnvironmentController validates name/label parameters via PathUtils.isInvalidEncodedLocation() rejecting \"..\" and \"#\", (2) GenericResourceRepository verifies resolved resources remain within allowed locations via PathUtils.checkResource(). The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.1.0, < 2.1.9; >= 2.2.0, < 2.2.3), NVD (>= 2.1.0, < 2.1.9; >= 2.2.0, < 2.2.3), cve.org (>= 2.1, < 2.1.9; >= 2.2, < 2.2.3), Snyk (>= 2.1.0, < 2.1.9; >= 2.2.0, < 2.2.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@4.2.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@4.2.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T15:30:49.741847+00:00",
      "status_notes": "Vulnerability CVE-2025-22232 does not affect version 4.2.4-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server. not_affected \u2014 CVE-2025-22232 describes a vulnerability where Spring Cloud Config Server reuses the first Vault token it receives via X-CONFIG-TOKEN header for all subsequent requests, causing authorization bypass. The target repository (spring-cloud-config 4.2.4) is NOT AFFECTED because the upstream fix was already present in the 4.2.4 release when TuxCare onboarded it. The fix introduces StatelessSessionMan...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22232"
      },
      "impact_statement": "not_affected \u2014 CVE-2025-22232 describes a vulnerability where Spring Cloud Config Server reuses the first Vault token it receives via X-CONFIG-TOKEN header for all subsequent requests, causing authorization bypass. The target repository (spring-cloud-config 4.2.4) is NOT AFFECTED because the upstream fix was already present in the 4.2.4 release when TuxCare onboarded it. The fix introduces StatelessSessionMan..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@4.2.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@4.2.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T15:30:49.741847+00:00",
      "status_notes": "Vulnerability CVE-2026-22739 affects version 4.2.4-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server.",
      "vulnerability": {
        "name": "CVE-2026-22739"
      },
      "action_statement": "Vulnerability CVE-2026-22739 affects version 4.2.4-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@4.2.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@4.2.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T15:30:49.741847+00:00",
      "status_notes": "Vulnerability CVE-2026-40981 is fixed in version 4.2.4-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server.",
      "vulnerability": {
        "name": "CVE-2026-40981"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@4.2.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@4.2.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T15:30:49.741847+00:00",
      "status_notes": "Vulnerability CVE-2026-40982 is fixed in version 4.2.4-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server.",
      "vulnerability": {
        "name": "CVE-2026-40982"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@4.2.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@4.2.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T15:30:49.741847+00:00",
      "status_notes": "Vulnerability CVE-2026-41002 is fixed in version 4.2.4-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server.",
      "vulnerability": {
        "name": "CVE-2026-41002"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@4.2.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@4.2.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T15:30:49.741847+00:00",
      "status_notes": "Vulnerability CVE-2026-41004 is fixed in version 4.2.4-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server.",
      "vulnerability": {
        "name": "CVE-2026-41004"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@4.2.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@4.2.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T15:30:49.741847+00:00",
      "status_notes": "Vulnerability CVE-2026-47836 is fixed in version 4.2.4-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server.",
      "vulnerability": {
        "name": "CVE-2026-47836"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@4.2.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@4.2.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T15:30:49.741847+00:00",
      "status_notes": "Vulnerability CVE-2026-47837 is fixed in version 4.2.4-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server.",
      "vulnerability": {
        "name": "CVE-2026-47837"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@4.2.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@4.2.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T15:30:49.741847+00:00",
      "status_notes": "Vulnerability CVE-2026-47894 is fixed in version 4.2.4-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server.",
      "vulnerability": {
        "name": "CVE-2026-47894"
      }
    }
  ]
}