{
  "@id": "urn:uuid:dbfd6174-f01f-447a-8fd9-53868e66505e",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 24,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:42:49.066061+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-bom@5.7.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-bom@5.7.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2007-1651 is a false positive for org.springframework.security:spring-security-bom 5.7.12-tuxcare.2. False positive \u2014 OpenID CVE, not related to Spring Security. CVE-2007-1651 affects OpenID Provider application handling of cached \u201calways trust\u201d authorization. Spring Security is a relying-party consumer; its DISCOVERY_INFO_KEY cleanup only prevents reuse of local callback/discovery state and does not address the provider-side forced-login flaw. No upstream evidence identifies Spring Security as an affected product.",
      "vulnerability": {
        "name": "CVE-2007-1651"
      },
      "impact_statement": "False positive \u2014 OpenID CVE, not related to Spring Security. CVE-2007-1651 affects OpenID Provider application handling of cached \u201calways trust\u201d authorization. Spring Security is a relying-party consumer; its DISCOVERY_INFO_KEY cleanup only prevents reuse of local callback/discovery state and does not address the provider-side forced-login flaw. No upstream evidence identifies Spring Security as an affected product."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-bom@5.7.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-bom@5.7.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-20T10:05:00.136501+00:00",
      "status_notes": "Vulnerability CVE-2007-1652 is a false positive for org.springframework.security:spring-security-bom 5.7.12-tuxcare.2. direct vulnerability is in OpenID project",
      "vulnerability": {
        "name": "CVE-2007-1652"
      },
      "impact_statement": "direct vulnerability is in OpenID project"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-bom@5.7.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-bom@5.7.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:42:49.066061+00:00",
      "status_notes": "Vulnerability CVE-2021-22112 does not affect version 5.7.12-tuxcare.2 of org.springframework.security:spring-security-bom. CVE-2021-22112 is not present in Spring Security 5.7.12. The upstream fix (commit c72a6fac04, dated 2021-01-22) that resolves the SecurityContext multiple-save bug was already included in the upstream 5.7.12 release (2024-03-18) before TuxCare onboarded it. The fix adds invocation tracking (isSaveContextInvoked flag) and modifies contextChanged() to ensure the FINAL SecurityContext is saved when changed multiple times per request, preventing privilege extension. All fix elements are present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22112"
      },
      "impact_statement": "CVE-2021-22112 is not present in Spring Security 5.7.12. The upstream fix (commit c72a6fac04, dated 2021-01-22) that resolves the SecurityContext multiple-save bug was already included in the upstream 5.7.12 release (2024-03-18) before TuxCare onboarded it. The fix adds invocation tracking (isSaveContextInvoked flag) and modifies contextChanged() to ensure the FINAL SecurityContext is saved when changed multiple times per request, preventing privilege extension. All fix elements are present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE)."
    }
  ]
}