{ "@id": "urn:uuid:00bc7d13-022e-4de6-80c7-73b289ba4250", "role": "Document Creator", "author": "https://tuxcare.com", "version": 10, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-04T09:02:00.202619+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@4.3.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@4.3.4-tuxcare.1" } } ], "timestamp": "2026-11-03T09:24:00.046346+00:00", "status_notes": "Vulnerability CVE-2019-3799 does not affect version 4.3.4-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server. not_affected \u2014 CVE-2019-3799 is NOT present in the target. The upstream fix (commit 3632fc6f by Spencer Gibb) that addresses the directory traversal vulnerability was already included in Spring Cloud Config 4.3.4 when TuxCare onboarded it. The target code contains the complete defense: PathUtils.isInvalidPath() and PathUtils.isInvalidEncodedPath() validation methods that reject paths containing \"..\" after nor...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-3799" }, "impact_statement": "not_affected \u2014 CVE-2019-3799 is NOT present in the target. The upstream fix (commit 3632fc6f by Spencer Gibb) that addresses the directory traversal vulnerability was already included in Spring Cloud Config 4.3.4 when TuxCare onboarded it. The target code contains the complete defense: PathUtils.isInvalidPath() and PathUtils.isInvalidEncodedPath() validation methods that reject paths containing \"..\" after nor..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@4.3.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@4.3.4-tuxcare.1" } } ], "timestamp": "2026-11-03T09:23:00.058016+00:00", "status_notes": "Vulnerability CVE-2020-5405 does not affect version 4.3.4-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server. not_affected \u2014 CVE-2020-5405 directory traversal vulnerability is NOT present in spring-cloud-config 4.3.4-tuxcare.1. The fix (commit 651f458919c40ef9a5e93e7d76bf98575910fad0) was already included in the upstream release 4.3.4 that TuxCare onboarded. The fix adds URL-decoding validation to reject location parameters containing \"..\" sequences, preventing arbitrary file access outside intended configuration dir...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-5405" }, "impact_statement": "not_affected \u2014 CVE-2020-5405 directory traversal vulnerability is NOT present in spring-cloud-config 4.3.4-tuxcare.1. The fix (commit 651f458919c40ef9a5e93e7d76bf98575910fad0) was already included in the upstream release 4.3.4 that TuxCare onboarded. The fix adds URL-decoding validation to reject location parameters containing \"..\" sequences, preventing arbitrary file access outside intended configuration dir..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@4.3.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@4.3.4-tuxcare.1" } } ], "timestamp": "2026-11-04T09:02:00.202619+00:00", "status_notes": "Vulnerability CVE-2020-5410 does not affect version 4.3.4-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server. CVE-2020-5410 affects Spring Cloud Config versions 2.1.x prior to 2.1.9 and 2.2.x prior to 2.2.3, allowing directory traversal attacks via specially crafted URLs. The target version 4.3.4 is NOT AFFECTED because the upstream vendor fix was already present in the 4.3.4 release when TuxCare onboarded it in October 2026. The fix was added by upstream developers in March-May 2020 (commits 1c01d11b and f470b52f), more than 6 years before TuxCare's onboarding. Both defense layers are active: (1) input validation in EnvironmentController.normalize() and ResourceController.normalize() rejecting path parameters containing \"..\", \"#\", or wildcards, and (2) resource containment verification in GenericResourceRepository via PathUtils.checkResource() ensuring resolved files are within allowed directories.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.1.0, < 2.1.9; >= 2.2.0, < 2.2.3), NVD (>= 2.1.0, < 2.1.9; >= 2.2.0, < 2.2.3), cve.org (>= 2.1, < 2.1.9; >= 2.2, < 2.2.3), Snyk (>= 2.1.0, < 2.1.9; >= 2.2.0, < 2.2.3).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-5410" }, "impact_statement": "CVE-2020-5410 affects Spring Cloud Config versions 2.1.x prior to 2.1.9 and 2.2.x prior to 2.2.3, allowing directory traversal attacks via specially crafted URLs. The target version 4.3.4 is NOT AFFECTED because the upstream vendor fix was already present in the 4.3.4 release when TuxCare onboarded it in October 2026. The fix was added by upstream developers in March-May 2020 (commits 1c01d11b and f470b52f), more than 6 years before TuxCare's onboarding. Both defense layers are active: (1) input validation in EnvironmentController.normalize() and ResourceController.normalize() rejecting path parameters containing \"..\", \"#\", or wildcards, and (2) resource containment verification in GenericResourceRepository via PathUtils.checkResource() ensuring resolved files are within allowed directories.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.1.0, < 2.1.9; >= 2.2.0, < 2.2.3), NVD (>= 2.1.0, < 2.1.9; >= 2.2.0, < 2.2.3), cve.org (>= 2.1, < 2.1.9; >= 2.2, < 2.2.3), Snyk (>= 2.1.0, < 2.1.9; >= 2.2.0, < 2.2.3)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@4.3.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@4.3.4-tuxcare.1" } } ], "timestamp": "2026-10-29T02:36:49.908127+00:00", "status_notes": "Vulnerability CVE-2025-22232 does not affect version 4.3.4-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server. not_affected \u2014 The target repository spring-cloud-config version 4.3.4-tuxcare.1 is NOT AFFECTED by CVE-2025-22232. The upstream vendor fix (commit 72d7e1502f264d9b477f2ed4fd3004e20564ad90 authored by ryan.baxter@broadcom.com) was already present in the Spring Cloud Config 4.3.4 release when TuxCare onboarded it. The fix introduces a StatelessSessionManager that retrieves Vault tokens from the current request...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-22232" }, "impact_statement": "not_affected \u2014 The target repository spring-cloud-config version 4.3.4-tuxcare.1 is NOT AFFECTED by CVE-2025-22232. The upstream vendor fix (commit 72d7e1502f264d9b477f2ed4fd3004e20564ad90 authored by ryan.baxter@broadcom.com) was already present in the Spring Cloud Config 4.3.4 release when TuxCare onboarded it. The fix introduces a StatelessSessionManager that retrieves Vault tokens from the current request..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@4.3.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@4.3.4-tuxcare.1" } } ], "timestamp": "2026-11-03T11:40:17.696488+00:00", "status_notes": "Vulnerability CVE-2026-22739 does not affect version 4.3.4-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server. CVE-2026-22739 does not affect spring-cloud-config 4.3.4-tuxcare.1. The fix (commit 1870f07b \"Protect against invalid use of profiles\") was authored by Ryan Baxter (ryan.baxter@broadcom.com) and shipped in upstream version 4.3.4 before TuxCare onboarding (commit 4519d99b). The target contains all three protection mechanisms from the patch: (1) profile parameter validation against directory traversal sequences (.. / %2e%2e) via isInvalidProfiles() which calls isInvalidEncodedLocation(), (2) same validation in ResourceController, and (3) SSRF protection via validateNoTemplateInAuthority() in AbstractScmAccessor that rejects template placeholders in URI host/port. These protections were further enhanced in upstream commit 7709cd0e and made configurable (enabled by default) in commit 5a4d4aac, all before TuxCare onboarding. The vulnerable pattern is not present in the shipped code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.3.0, < 4.3.2; >= 5.0.0-M1, < 5.0.2; >= 4.2.0, <= 4.2.4; >= 4.0.0, <= 4.1.7; <= 3.1.10), NVD (< 3.1.13; >= 4.1.0, < 4.1.9; >= 4.2.0, < 4.2.6; >= 4.3.0, < 4.3.2; >= 5.0.0, < 5.0.2), cve.org (>= 3.1.x, < 3.1.13; >= 4.1.x, < 4.1.9; >= 4.2.x, < 4.2.3; >= 4.3.x, < 4.3.2; >= 5.0.x, < 5.0.2), Snyk (< 4.3.2; >= 5.0.0-M1, < 5.0.2).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-22739" }, "impact_statement": "CVE-2026-22739 does not affect spring-cloud-config 4.3.4-tuxcare.1. The fix (commit 1870f07b \"Protect against invalid use of profiles\") was authored by Ryan Baxter (ryan.baxter@broadcom.com) and shipped in upstream version 4.3.4 before TuxCare onboarding (commit 4519d99b). The target contains all three protection mechanisms from the patch: (1) profile parameter validation against directory traversal sequences (.. / %2e%2e) via isInvalidProfiles() which calls isInvalidEncodedLocation(), (2) same validation in ResourceController, and (3) SSRF protection via validateNoTemplateInAuthority() in AbstractScmAccessor that rejects template placeholders in URI host/port. These protections were further enhanced in upstream commit 7709cd0e and made configurable (enabled by default) in commit 5a4d4aac, all before TuxCare onboarding. The vulnerable pattern is not present in the shipped code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.3.0, < 4.3.2; >= 5.0.0-M1, < 5.0.2; >= 4.2.0, <= 4.2.4; >= 4.0.0, <= 4.1.7; <= 3.1.10), NVD (< 3.1.13; >= 4.1.0, < 4.1.9; >= 4.2.0, < 4.2.6; >= 4.3.0, < 4.3.2; >= 5.0.0, < 5.0.2), cve.org (>= 3.1.x, < 3.1.13; >= 4.1.x, < 4.1.9; >= 4.2.x, < 4.2.3; >= 4.3.x, < 4.3.2; >= 5.0.x, < 5.0.2), Snyk (< 4.3.2; >= 5.0.0-M1, < 5.0.2)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@4.3.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@4.3.4-tuxcare.1" } } ], "timestamp": "2026-10-28T16:44:22.563651+00:00", "status_notes": "Vulnerability CVE-2026-40981 does not affect version 4.3.4-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server. Spring Cloud Config 4.3.4 is not vulnerable as it is higher than upstream fix version - 4.3.3", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-40981" }, "impact_statement": "Spring Cloud Config 4.3.4 is not vulnerable as it is higher than upstream fix version - 4.3.3" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@4.3.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@4.3.4-tuxcare.1" } } ], "timestamp": "2026-10-28T16:44:22.563651+00:00", "status_notes": "Vulnerability CVE-2026-40982 does not affect version 4.3.4-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server. Spring Cloud Config 4.3.4 is not vulnerable as it is higher than upstream fix version - 4.3.3", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-40982" }, "impact_statement": "Spring Cloud Config 4.3.4 is not vulnerable as it is higher than upstream fix version - 4.3.3" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@4.3.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@4.3.4-tuxcare.1" } } ], "timestamp": "2026-10-28T16:44:22.563651+00:00", "status_notes": "Vulnerability CVE-2026-41002 does not affect version 4.3.4-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server. Spring Cloud Config 4.3.4 is not affected by CVE-2026-41002. The TOCTOU vulnerability in git basedir handling was fixed by upstream vendor (Spring/VMware) in commit cc71e5c3 (Harden file system manipulation when using Git repos), first released in 4.3.3; the Spring advisory lists 4.3.0 to 4.3.2 as affected and 4.3.3 as fixed. This fix is included in the upstream 4.3.4 release. All defense mechanisms are present in JGitEnvironmentRepository: symlink rejection via NOFOLLOW_LINKS, exclusive directory creation, and re-verification before clone. The vulnerable pattern is not present because the upstream vendor already fixed it before 4.3.4.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41002" }, "impact_statement": "Spring Cloud Config 4.3.4 is not affected by CVE-2026-41002. The TOCTOU vulnerability in git basedir handling was fixed by upstream vendor (Spring/VMware) in commit cc71e5c3 (Harden file system manipulation when using Git repos), first released in 4.3.3; the Spring advisory lists 4.3.0 to 4.3.2 as affected and 4.3.3 as fixed. This fix is included in the upstream 4.3.4 release. All defense mechanisms are present in JGitEnvironmentRepository: symlink rejection via NOFOLLOW_LINKS, exclusive directory creation, and re-verification before clone. The vulnerable pattern is not present because the upstream vendor already fixed it before 4.3.4." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@4.3.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@4.3.4-tuxcare.1" } } ], "timestamp": "2026-10-28T16:44:22.563651+00:00", "status_notes": "Vulnerability CVE-2026-41004 does not affect version 4.3.4-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server. Spring Cloud Config 4.3.4 is not vulnerable as it is higher than upstream fix version - 4.3.3", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41004" }, "impact_statement": "Spring Cloud Config 4.3.4 is not vulnerable as it is higher than upstream fix version - 4.3.3" }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@4.3.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@4.3.4-tuxcare.1" } } ], "timestamp": "2026-10-28T16:44:45.949987+00:00", "status_notes": "Vulnerability CVE-2026-47836 is fixed in version 4.3.4-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server.", "vulnerability": { "name": "CVE-2026-47836" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@4.3.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@4.3.4-tuxcare.1" } } ], "timestamp": "2026-10-28T16:44:45.949987+00:00", "status_notes": "Vulnerability CVE-2026-47837 is fixed in version 4.3.4-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server.", "vulnerability": { "name": "CVE-2026-47837" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@4.3.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.cloud/spring-cloud-config-server@4.3.4-tuxcare.1" } } ], "timestamp": "2026-10-28T16:44:45.949987+00:00", "status_notes": "Vulnerability CVE-2026-47894 is fixed in version 4.3.4-tuxcare.1 of org.springframework.cloud:spring-cloud-config-server.", "vulnerability": { "name": "CVE-2026-47894" } } ] }