{
  "@id": "urn:uuid:c0fe5a05-050b-4737-ba74-77ee3ba82200",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 22,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:45:34.333226+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-bom@6.2.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-bom@6.2.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-03T12:45:34.333226+00:00",
      "status_notes": "Vulnerability CVE-2021-22112 does not affect version 6.2.7-tuxcare.7 of org.springframework.security:spring-security-bom. CVE-2021-22112 affects Spring Security versions that fail to save the SecurityContext when it is changed more than once in a single request. The target repository (Spring Security 6.2.7-tuxcare.8) already contains the upstream fix introduced in commit 3116369f027 by Rob Winch on 2021-01-22. This fix adds a `isSaveContextInvoked` flag to track saveContext() invocations and modifies the contextChanged() method to ensure all context changes are persisted. Since the fix was already present in the upstream release that TuxCare onboarded (before the first TuxCare commit f09fc6dd88), the target is not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22112"
      },
      "impact_statement": "CVE-2021-22112 affects Spring Security versions that fail to save the SecurityContext when it is changed more than once in a single request. The target repository (Spring Security 6.2.7-tuxcare.8) already contains the upstream fix introduced in commit 3116369f027 by Rob Winch on 2021-01-22. This fix adds a `isSaveContextInvoked` flag to track saveContext() invocations and modifies the contextChanged() method to ensure all context changes are persisted. Since the fix was already present in the upstream release that TuxCare onboarded (before the first TuxCare commit f09fc6dd88), the target is not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE)."
    }
  ]
}