{
  "@id": "urn:uuid:dba77bbd-ebcd-447f-82d2-e0fa74bcb51f",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 5,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T18:10:39.121199+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.ldap/spring-ldap-core@2.4.4-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.ldap/spring-ldap-core@2.4.4-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-06T18:10:39.121199+00:00",
      "status_notes": "Vulnerability CVE-2017-8028 does not affect version 2.4.4-tuxcare.8 of org.springframework.ldap:spring-ldap-core. Prechecker: The upstream fix is already in this version's source history (commits 08e8ae28, bdbbd72b). Version 2.4.4 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-pjqh-2jcc-5j84 (affected up to 2.3.2), NVD (affected up to 2.3.1), Snyk (affected up to 2.3.2.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-8028"
      },
      "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commits 08e8ae28, bdbbd72b). Version 2.4.4 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-pjqh-2jcc-5j84 (affected up to 2.3.2), NVD (affected up to 2.3.1), Snyk (affected up to 2.3.2.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.ldap/spring-ldap-core@2.4.4-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.ldap/spring-ldap-core@2.4.4-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2024-38829 does not affect version 2.4.4-tuxcare.8 of org.springframework.ldap:spring-ldap-core. not_affected \u2014 The target repository (Spring LDAP 2.4.4-tuxcare.11) is NOT AFFECTED by CVE-2024-38829. The vulnerability involved locale-dependent case conversion in LDAP attribute matching that could lead to data exposure. The upstream fix (commit 1bfb466c) added explicit Locale.ROOT parameters to all toLowerCase() and toUpperCase() calls, and this fix was already present in the upstream 2.4.4 release that T...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38829"
      },
      "impact_statement": "not_affected \u2014 The target repository (Spring LDAP 2.4.4-tuxcare.11) is NOT AFFECTED by CVE-2024-38829. The vulnerability involved locale-dependent case conversion in LDAP attribute matching that could lead to data exposure. The upstream fix (commit 1bfb466c) added explicit Locale.ROOT parameters to all toLowerCase() and toUpperCase() calls, and this fix was already present in the upstream 2.4.4 release that T..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.ldap/spring-ldap-core@2.4.4-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.ldap/spring-ldap-core@2.4.4-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41720 is fixed in version 2.4.4-tuxcare.8 of org.springframework.ldap:spring-ldap-core.",
      "vulnerability": {
        "name": "CVE-2026-41720"
      }
    }
  ]
}