{ "@id": "urn:uuid:4a57dfbd-86d9-4909-990a-80f64d8f52e0", "role": "Document Creator", "author": "https://tuxcare.com", "version": 44, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-10T15:50:03.446715+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2007-1651 does not affect version 4.2.20.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core. Version 4.2.20.RELEASE is not vulnerable. Summary: The target repository is NOT VULNERABLE to CVE-2007-1651. The security fix has already been applied.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2007-1651" }, "impact_statement": "Version 4.2.20.RELEASE is not vulnerable. Summary: The target repository is NOT VULNERABLE to CVE-2007-1651. The security fix has already been applied." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2007-1652 does not affect version 4.2.20.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core. Version 4.2.20.RELEASE is not vulnerable. Summary: The target repository is NOT VULNERABLE to CVE-2007-1652. The security fix has already been applied. The code contains the necessary null check for DiscoveryInformation that prevents replay attacks and session-based exploitation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2007-1652" }, "impact_statement": "Version 4.2.20.RELEASE is not vulnerable. Summary: The target repository is NOT VULNERABLE to CVE-2007-1652. The security fix has already been applied. The code contains the necessary null check for DiscoveryInformation that prevents replay attacks and session-based exploitation." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-30T20:55:45.924382+00:00", "status_notes": "Vulnerability CVE-2010-3700 does not affect version 4.2.20.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2010-3700 (SEC-1584) addresses path parameter bypass attacks where attackers add semicolon-delimited parameters to URLs to evade security constraints. The fix introduces HttpFirewall infrastructure (RequestWrapper, DefaultHttpFirewall, StrictHttpFirewall) that strips or rejects path parameters before security pattern matching. This fix was already present in upstream release 4.2.20.RELEASE ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2010-3700" }, "impact_statement": "not_affected \u2014 CVE-2010-3700 (SEC-1584) addresses path parameter bypass attacks where attackers add semicolon-delimited parameters to URLs to evade security constraints. The fix introduces HttpFirewall infrastructure (RequestWrapper, DefaultHttpFirewall, StrictHttpFirewall) that strips or rejects path parameters before security pattern matching. This fix was already present in upstream release 4.2.20.RELEASE ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-30T19:27:06.993959+00:00", "status_notes": "Vulnerability CVE-2011-2731 does not affect version 4.2.20.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2011-2731 is not present in Spring Security 4.2.20.RELEASE. The vulnerability (race condition in RunAsManager causing privilege escalation via shared SecurityContext) was fixed upstream in 2011-2012 through commits SEC-1750 and SEC-1967. The target version already contains both fixes: (1) SecurityContext isolation - creating a new empty context for RunAs authentication instead of reusing a ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2011-2731" }, "impact_statement": "not_affected \u2014 CVE-2011-2731 is not present in Spring Security 4.2.20.RELEASE. The vulnerability (race condition in RunAsManager causing privilege escalation via shared SecurityContext) was fixed upstream in 2011-2012 through commits SEC-1750 and SEC-1967. The target version already contains both fixes: (1) SecurityContext isolation - creating a new empty context for RunAs authentication instead of reusing a ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-30T23:03:51.446853+00:00", "status_notes": "Vulnerability CVE-2011-2732 does not affect version 4.2.20.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 The target repository (Spring Security 4.2.20.RELEASE) is NOT AFFECTED by CVE-2011-2732. The vulnerability (CRLF injection in logout redirect via spring-security-redirect parameter) was fixed in upstream commit 824464516c by Luke Taylor, which shipped in the upstream 4.2.20.RELEASE before TuxCare onboarded the code. Both defense mechanisms from the vendor patches are present: (1) FirewalledResp...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2011-2732" }, "impact_statement": "not_affected \u2014 The target repository (Spring Security 4.2.20.RELEASE) is NOT AFFECTED by CVE-2011-2732. The vulnerability (CRLF injection in logout redirect via spring-security-redirect parameter) was fixed in upstream commit 824464516c by Luke Taylor, which shipped in the upstream 4.2.20.RELEASE before TuxCare onboarded the code. Both defense mechanisms from the vendor patches are present: (1) FirewalledResp..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-30T22:43:24.671535+00:00", "status_notes": "Vulnerability CVE-2011-2894 does not affect version 4.2.20.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 CVE-2011-2894 is NOT present in Spring Security 4.2.20.RELEASE-tuxcare.7. The vulnerable deserialization pattern (serializing entire SecurityContext objects via RMI) was fixed in 2011 via SEC-1741 (commit ba719dc0e1) by replacing object serialization with String-only transmission. This fix was already present in the upstream Spring Security 4.2.20.RELEASE (released Dec 2020) before TuxCare onbo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2011-2894" }, "impact_statement": "not_affected \u2014 CVE-2011-2894 is NOT present in Spring Security 4.2.20.RELEASE-tuxcare.7. The vulnerable deserialization pattern (serializing entire SecurityContext objects via RMI) was fixed in 2011 via SEC-1741 (commit ba719dc0e1) by replacing object serialization with String-only transmission. This fix was already present in the upstream Spring Security 4.2.20.RELEASE (released Dec 2020) before TuxCare onbo..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-30T21:14:20.175704+00:00", "status_notes": "Vulnerability CVE-2012-5055 does not affect version 4.2.20.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 The target Spring Security 4.2.20.RELEASE is not affected by CVE-2012-5055. The timing attack vulnerability (username enumeration via response-time differences) was fixed in upstream Spring Security 3.1.3 (September 2012) by commit c076f0f2e1. This fix was already present in the upstream 4.2.20.RELEASE when TuxCare onboarded the version. The mitigation code performs password validation against ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2012-5055" }, "impact_statement": "not_affected \u2014 The target Spring Security 4.2.20.RELEASE is not affected by CVE-2012-5055. The timing attack vulnerability (username enumeration via response-time differences) was fixed in upstream Spring Security 3.1.3 (September 2012) by commit c076f0f2e1. This fix was already present in the upstream 4.2.20.RELEASE when TuxCare onboarded the version. The mitigation code performs password validation against ..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-29T07:42:31.773838+00:00", "status_notes": "Vulnerability CVE-2014-0097 affects version 4.2.20.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core.", "vulnerability": { "name": "CVE-2014-0097" }, "action_statement": "Vulnerability CVE-2014-0097 affects version 4.2.20.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1" } } ], "timestamp": "2026-11-04T17:02:56.342548+00:00", "status_notes": "Vulnerability CVE-2014-3527 does not affect version 4.2.20.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core. CVE-2014-3527 does not affect Spring Security 4.2.20.RELEASE. The vulnerability (CAS proxy ticket authentication using untrusted HTTP Host headers instead of configured service URL) was fixed by upstream commit 934937d9c1 (SEC-2688) authored by Rob Winch in July 2014. This fix was already present in Spring Security 4.2.20.RELEASE when TuxCare onboarded it. The target code correctly uses the configured casService URL (protocol, host, port) instead of HTTP request headers when constructing the service authentication URL, preventing attackers from manipulating the Host header to bypass service-to-service access controls.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-3527" }, "impact_statement": "CVE-2014-3527 does not affect Spring Security 4.2.20.RELEASE. The vulnerability (CAS proxy ticket authentication using untrusted HTTP Host headers instead of configured service URL) was fixed by upstream commit 934937d9c1 (SEC-2688) authored by Rob Winch in July 2014. This fix was already present in Spring Security 4.2.20.RELEASE when TuxCare onboarded it. The target code correctly uses the configured casService URL (protocol, host, port) instead of HTTP request headers when constructing the service authentication URL, preventing attackers from manipulating the Host header to bypass service-to-service access controls." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1" } } ], "timestamp": "2026-11-03T12:31:59.702907+00:00", "status_notes": "Vulnerability CVE-2016-5007 does not affect version 4.2.20.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core. CVE-2016-5007 addresses URL pattern matching discrepancies between Spring Security authorization and Spring MVC controller mapping. The target version 4.2.20.RELEASE-tuxcare.7 contains both upstream fixes: (1) MvcRequestMatcher class enabling Spring Security to use Spring MVC's URL matching rules, and (2) DefaultHttpFirewall blocking URL-encoded slashes (%2f/%2F) to prevent path manipulation. Both fixes were authored by Rob Winch (rwinch@gopivotal.com) and shipped in upstream Spring Security 4.2.20.RELEASE before TuxCare onboarded the version. The vulnerable pattern (absence of these defenses) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-5007" }, "impact_statement": "CVE-2016-5007 addresses URL pattern matching discrepancies between Spring Security authorization and Spring MVC controller mapping. The target version 4.2.20.RELEASE-tuxcare.7 contains both upstream fixes: (1) MvcRequestMatcher class enabling Spring Security to use Spring MVC's URL matching rules, and (2) DefaultHttpFirewall blocking URL-encoded slashes (%2f/%2F) to prevent path manipulation. Both fixes were authored by Rob Winch (rwinch@gopivotal.com) and shipped in upstream Spring Security 4.2.20.RELEASE before TuxCare onboarded the version. The vulnerable pattern (absence of these defenses) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.1.1), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 3.2.10; = 4.0.0; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4; = 4.1.0), cve.org (>= 3.2, < 3.3; >= 4.0, < 4.1; = 4.1.0), Snyk (>= 3.2.0.RELEASE, < 4.1.1.RELEASE; >= 3.2.0.RELEASE, < 4.1.1.RELEASE)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1" } } ], "timestamp": "2026-11-03T12:07:34.733429+00:00", "status_notes": "Vulnerability CVE-2016-9879 does not affect version 4.2.20.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core. CVE-2016-9879 is not present in Spring Security 4.2.20.RELEASE. The vulnerability (lack of URL-encoded slash validation allowing security constraint bypass) was fixed in upstream version 4.2.1.RELEASE. The target version 4.2.20.RELEASE contains the fix in DefaultHttpFirewall.java, which checks for %2f/%2F in request URIs and rejects them with RequestRejectedException (lines 60-63, 91-101). The defense is enabled by default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-9879" }, "impact_statement": "CVE-2016-9879 is not present in Spring Security 4.2.20.RELEASE. The vulnerability (lack of URL-encoded slash validation allowing security constraint bypass) was fixed in upstream version 4.2.1.RELEASE. The target version 4.2.20.RELEASE contains the fix in DefaultHttpFirewall.java, which checks for %2f/%2F in request URIs and rejects them with RequestRejectedException (lines 60-63, 91-101). The defense is enabled by default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE), NVD (= 3.2.0; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 3.2.9; = 4.1.0; = 4.1.1; = 4.1.2; = 4.1.3; = 4.2.0), Snyk (>= 3.2.0.RELEASE, < 3.2.10.RELEASE; >= 4.0.0.RELEASE, < 4.1.4.RELEASE; >= 4.2.0.RELEASE, < 4.2.1.RELEASE; <= 0)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1" } } ], "timestamp": "2026-11-04T09:15:51.446651+00:00", "status_notes": "Vulnerability CVE-2017-4995 does not affect version 4.2.20.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core. Target Spring Security 4.2.20.RELEASE is NOT AFFECTED by CVE-2017-4995. The vulnerability (unrestricted Jackson deserialization allowing arbitrary code execution) was fixed in upstream Spring Security 4.2.3.RELEASE (May 2017) by commit 947d11f433, authored by Rob Winch. The fix replaces unrestricted enableDefaultTyping() with a whitelisting TypeIdResolver that rejects non-whitelisted classes unless they have explicit mixins or Jackson annotations. This fix was already present in upstream 4.2.20.RELEASE when TuxCare onboarded it, so the vulnerable pattern never existed in the target version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-4995" }, "impact_statement": "Target Spring Security 4.2.20.RELEASE is NOT AFFECTED by CVE-2017-4995. The vulnerability (unrestricted Jackson deserialization allowing arbitrary code execution) was fixed in upstream Spring Security 4.2.3.RELEASE (May 2017) by commit 947d11f433, authored by Rob Winch. The fix replaces unrestricted enableDefaultTyping() with a whitelisting TypeIdResolver that rejects non-whitelisted classes unless they have explicit mixins or Jackson annotations. This fix was already present in upstream 4.2.20.RELEASE when TuxCare onboarded it, so the vulnerable pattern never existed in the target version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.2.0.RELEASE, < 4.2.3.RELEASE; >= 5.0.0.M1, < 5.0.0.M2), NVD (= 4.2.0-release; = 4.2.1-release; = 4.2.2-release; = 5.0.0-m1), cve.org (= 4.2.0.RELEASE; = 4.2.2.RELEASE; = 5.0.0.M1), Snyk (>= 4.2.0.RELEASE, < 4.2.3.RELEASE)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1" } } ], "timestamp": "2026-11-03T16:45:07.357611+00:00", "status_notes": "Vulnerability CVE-2018-1199 does not affect version 4.2.20.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 The target repository (Spring Security 4.2.20.RELEASE) is NOT affected by CVE-2018-1199. The vulnerability involves bypassing security constraints via URL path parameters with special encodings (semicolons, encoded slashes, etc.). The fix (StrictHttpFirewall) was introduced in upstream Spring Security 4.2.4 and is present in 4.2.20.RELEASE. Both FilterChainProxy and WebSecurity use StrictHttpFi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1199" }, "impact_statement": "not_affected \u2014 The target repository (Spring Security 4.2.20.RELEASE) is NOT affected by CVE-2018-1199. The vulnerability involves bypassing security constraints via URL path parameters with special encodings (semicolons, encoded slashes, etc.). The fix (StrictHttpFirewall) was introduced in upstream Spring Security 4.2.4 and is present in 4.2.20.RELEASE. Both FilterChainProxy and WebSecurity use StrictHttpFi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1" } } ], "timestamp": "2026-11-06T18:35:19.509134+00:00", "status_notes": "Vulnerability CVE-2018-15801 does not affect version 4.2.20.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core. Prechecker: No vulnerable code from the fix was found; this version has none of the entry points of the fix's regression test and no class named after a file the fix changes. Version 4.2.20.RELEASE is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-27xw-p8v6-9jjr (newer lines only), CVE record (newer lines only).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15801" }, "impact_statement": "Prechecker: No vulnerable code from the fix was found; this version has none of the entry points of the fix's regression test and no class named after a file the fix changes. Version 4.2.20.RELEASE is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-27xw-p8v6-9jjr (newer lines only), CVE record (newer lines only)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1" } } ], "timestamp": "2026-11-03T12:23:26.744347+00:00", "status_notes": "Vulnerability CVE-2019-11272 does not affect version 4.2.20.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core. CVE-2019-11272 is not present in Spring Security 4.2.20.RELEASE. The vulnerability (null password bypass in PlaintextPasswordEncoder) was fixed in upstream commit b2d4fec3617c497c5a8eb9c7e5270e0c7db293ee by Rob Winch, which was already included in the upstream release before TuxCare onboarded this version. The fix adds a null check at line 54-56 that immediately returns false when encPass is null, preventing authentication bypass. Since this was an upstream fix present in the base release (before first TuxCare commit a868dcdcca7948205d78e9d4ff32b7fdb273217b), the vulnerable pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-11272" }, "impact_statement": "CVE-2019-11272 is not present in Spring Security 4.2.20.RELEASE. The vulnerability (null password bypass in PlaintextPasswordEncoder) was fixed in upstream commit b2d4fec3617c497c5a8eb9c7e5270e0c7db293ee by Rob Winch, which was already included in the upstream release before TuxCare onboarded this version. The fix adds a null check at line 54-56 that immediately returns false when encPass is null, preventing authentication bypass. Since this was an upstream fix present in the base release (before first TuxCare commit a868dcdcca7948205d78e9d4ff32b7fdb273217b), the vulnerable pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1" } } ], "timestamp": "2026-11-02T23:55:06.810370+00:00", "status_notes": "Vulnerability CVE-2019-3795 does not affect version 4.2.20.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 The target Spring Security 4.2.20.RELEASE repository is NOT affected by CVE-2019-3795. The vulnerability (insecure randomness when using SecureRandomFactoryBean#setSeed) was fixed by the upstream Spring Security team in commit 6f02f690ac, which was included in the 4.2.20 release before TuxCare onboarded it. The fix ensures nextBytes() is called to auto-seed the SecureRandom with system entropy ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-3795" }, "impact_statement": "not_affected \u2014 The target Spring Security 4.2.20.RELEASE repository is NOT affected by CVE-2019-3795. The vulnerability (insecure randomness when using SecureRandomFactoryBean#setSeed) was fixed by the upstream Spring Security team in commit 6f02f690ac, which was included in the 4.2.20 release before TuxCare onboarded it. The fix ensures nextBytes() is called to auto-seed the SecureRandom with system entropy ..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-29T07:42:31.773838+00:00", "status_notes": "Vulnerability CVE-2020-5407 affects version 4.2.20.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core.", "vulnerability": { "name": "CVE-2020-5407" }, "action_statement": "Vulnerability CVE-2020-5407 affects version 4.2.20.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-30T22:03:47.730298+00:00", "status_notes": "Vulnerability CVE-2020-5408 does not affect version 4.2.20.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 The target Spring Security version 4.2.20.RELEASE is not affected by CVE-2020-5408. The vulnerability concerns the queryableText() encryptor using a fixed null initialization vector (IV) with CBC mode, which allows dictionary attacks on encrypted data. The upstream vendor fix (commit fe737cc67de) deprecated the queryableText() method and added explicit security warnings in the documentation sta...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-5408" }, "impact_statement": "not_affected \u2014 The target Spring Security version 4.2.20.RELEASE is not affected by CVE-2020-5408. The vulnerability concerns the queryableText() encryptor using a fixed null initialization vector (IV) with CBC mode, which allows dictionary attacks on encrypted data. The upstream vendor fix (commit fe737cc67de) deprecated the queryableText() method and added explicit security warnings in the documentation sta..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-22119 does not affect version 4.2.20.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core. Version 4.2.20.RELEASE is not vulnerable. Summary: Target repository Spring Security 4.2.20.RELEASE does not contain the vulnerable OAuth2 client code. The vulnerable class HttpSessionOAuth2AuthorizationRequestRepository and the entire OAuth2 client module were introduced in Spring Security 5.0.0.M1, and the vulnerable Map-based storage pattern was added in 5.1.0.M1. Since the target version (4.2.x) predates the introduction of this feature by two major versions, the vulnerab [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-22119" }, "impact_statement": "Version 4.2.20.RELEASE is not vulnerable. Summary: Target repository Spring Security 4.2.20.RELEASE does not contain the vulnerable OAuth2 client code. The vulnerable class HttpSessionOAuth2AuthorizationRequestRepository and the entire OAuth2 client module were introduced in Spring Security 5.0.0.M1, and the vulnerable Map-based storage pattern was added in 5.1.0.M1. Since the target version (4.2.x) predates the introduction of this feature by two major versions, the vulnerab [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1" } } ], "timestamp": "2026-11-03T05:12:48.993608+00:00", "status_notes": "Vulnerability CVE-2022-22976 does not affect version 4.2.20.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 4.2.20.RELEASE is not affected by CVE-2022-22976. The vulnerability (integer overflow when log_rounds=31) was introduced in Spring Security 5.x in October 2018 via commit 388a7b62b906bd, which changed the rounds calculation from safe long arithmetic to vulnerable int arithmetic. The 4.2.20 version predates this change and has always used long arithmetic (since commit 14a5135ac3 ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22976" }, "impact_statement": "not_affected \u2014 Spring Security 4.2.20.RELEASE is not affected by CVE-2022-22976. The vulnerability (integer overflow when log_rounds=31) was introduced in Spring Security 5.x in October 2018 via commit 388a7b62b906bd, which changed the rounds calculation from safe long arithmetic to vulnerable int arithmetic. The 4.2.20 version predates this change and has always used long arithmetic (since commit 14a5135ac3 ..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-22978 is fixed in version 4.2.20.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core.", "vulnerability": { "name": "CVE-2022-22978" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1" } } ], "timestamp": "2026-11-06T18:18:00.046080+00:00", "status_notes": "Vulnerability CVE-2022-31692 does not affect version 4.2.20.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core. Prechecker: No vulnerable code from the fix was found; this version has none of the entry points of the fix's regression test and no class named after a file the fix changes. Version 4.2.20.RELEASE is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-mmmh-wcxm-2wr4 (newer lines only), NVD (newer lines only).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-31692" }, "impact_statement": "Prechecker: No vulnerable code from the fix was found; this version has none of the entry points of the fix's regression test and no class named after a file the fix changes. Version 4.2.20.RELEASE is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-mmmh-wcxm-2wr4 (newer lines only), NVD (newer lines only)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1" } } ], "timestamp": "2026-11-10T04:16:00.061099+00:00", "status_notes": "Vulnerability CVE-2023-20862 does not affect version 4.2.20.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because logout cleanup removes persisted authentication, including serialized copies, even when session invalidation is disabled. The persistence filter saves the cleared context in finally (web/src/main/java/org/springframework/security/web/context/SecurityContextPersistenceFilter.java:98). The session wrapper removes the authentication attribute without comparing context identities (web/src/main/java/org/springframework/security/web/context/HttpSessionSecurityContextRepository.java:340).", "vulnerability": { "name": "CVE-2023-20862" }, "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because logout cleanup removes persisted authentication, including serialized copies, even when session invalidation is disabled. The persistence filter saves the cleared context in finally (web/src/main/java/org/springframework/security/web/context/SecurityContextPersistenceFilter.java:98). The session wrapper removes the authentication attribute without comparing context identities (web/src/main/java/org/springframework/security/web/context/HttpSessionSecurityContextRepository.java:340)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-29T01:28:06.753409+00:00", "status_notes": "Vulnerability CVE-2024-22234 affects version 4.2.20.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core.", "vulnerability": { "name": "CVE-2024-22234" }, "action_statement": "Vulnerability CVE-2024-22234 affects version 4.2.20.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-22257 is fixed in version 4.2.20.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core.", "vulnerability": { "name": "CVE-2024-22257" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1" } } ], "timestamp": "2026-11-03T16:49:36.466974+00:00", "status_notes": "Vulnerability CVE-2024-38810 does not affect version 4.2.20.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 4.2.20.RELEASE is not affected by CVE-2024-38810. The vulnerability concerns the @AuthorizeReturnObject annotation and its AuthorizeReturnObjectMethodInterceptor implementation, which were introduced in Spring Security 6.3. Version 4.2.20.RELEASE predates this feature by several major releases and does not contain the annotation, interceptor, or proxy-wrapping authorization patt...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-38810" }, "impact_statement": "not_affected \u2014 Spring Security 4.2.20.RELEASE is not affected by CVE-2024-38810. The vulnerability concerns the @AuthorizeReturnObject annotation and its AuthorizeReturnObjectMethodInterceptor implementation, which were introduced in Spring Security 6.3. Version 4.2.20.RELEASE predates this feature by several major releases and does not contain the annotation, interceptor, or proxy-wrapping authorization patt..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38827 is fixed in version 4.2.20.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core.", "vulnerability": { "name": "CVE-2024-38827" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-29T02:15:57.456054+00:00", "status_notes": "Vulnerability CVE-2025-22223 does not affect version 4.2.20.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 4.2.20.RELEASE is not affected by CVE-2025-22223. The vulnerability is specific to the @EnableMethodSecurity annotation and UniqueSecurityAnnotationScanner class, both introduced in Spring Security 5.6+. Version 4.2.x uses the older @EnableGlobalMethodSecurity architecture with a completely different annotation scanning mechanism (PrePostAnnotationSecurityMetadataSource using Sp...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-22223" }, "impact_statement": "not_affected \u2014 Spring Security 4.2.20.RELEASE is not affected by CVE-2025-22223. The vulnerability is specific to the @EnableMethodSecurity annotation and UniqueSecurityAnnotationScanner class, both introduced in Spring Security 5.6+. Version 4.2.x uses the older @EnableGlobalMethodSecurity architecture with a completely different annotation scanning mechanism (PrePostAnnotationSecurityMetadataSource using Sp..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-22234 affects version 4.2.20.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core, and is fixed in 4.2.20.RELEASE-tuxcare.7.", "vulnerability": { "name": "CVE-2025-22234" }, "action_statement": "Vulnerability CVE-2025-22234 affects version 4.2.20.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core, and is fixed in 4.2.20.RELEASE-tuxcare.7." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-30T10:45:04.635215+00:00", "status_notes": "Vulnerability CVE-2025-41232 does not affect version 4.2.20.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 4.2.20.RELEASE does not contain that scanner, so it is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-41232" }, "impact_statement": "CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 4.2.20.RELEASE does not contain that scanner, so it is not affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-30T11:34:00.087002+00:00", "status_notes": "Vulnerability CVE-2025-41248 does not affect version 4.2.20.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core. CVE-2025-41248 affects the annotation lookup used by @EnableMethodSecurity. Spring Security 4.2.20.RELEASE predates @EnableMethodSecurity, which was added in 5.6, and has no such lookup, so it is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-41248" }, "impact_statement": "CVE-2025-41248 affects the annotation lookup used by @EnableMethodSecurity. Spring Security 4.2.20.RELEASE predates @EnableMethodSecurity, which was added in 5.6, and has no such lookup, so it is not affected." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22746 affects version 4.2.20.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core, and is fixed in 4.2.20.RELEASE-tuxcare.4.", "vulnerability": { "name": "CVE-2026-22746" }, "action_statement": "Vulnerability CVE-2026-22746 affects version 4.2.20.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core, and is fixed in 4.2.20.RELEASE-tuxcare.4." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-29T05:55:31.824924+00:00", "status_notes": "Vulnerability CVE-2026-22751 does not affect version 4.2.20.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 4.2.20.RELEASE is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService and the entire OneTimeToken authentication feature) does not exist in this version. The OneTimeToken feature was introduced in Spring Security 6.4.0-RC1 (September 2024), approximately 7 years after the 4.2.x release line. Exhaustive searches of the target codebase confirm no OneT...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-22751" }, "impact_statement": "not_affected \u2014 Spring Security 4.2.20.RELEASE is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService and the entire OneTimeToken authentication feature) does not exist in this version. The OneTimeToken feature was introduced in Spring Security 6.4.0-RC1 (September 2024), approximately 7 years after the 4.2.x release line. Exhaustive searches of the target codebase confirm no OneT..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-13T10:54:00.087057+00:00", "status_notes": "Vulnerability CVE-2026-59276 affects version 4.2.20.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core.", "vulnerability": { "name": "CVE-2026-59276" }, "action_statement": "Vulnerability CVE-2026-59276 affects version 4.2.20.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@4.2.20.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-29T10:38:18.047933+00:00", "status_notes": "Vulnerability CVE-2026-59277 does not affect version 4.2.20.RELEASE-tuxcare.1 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 4.2.20.RELEASE does not contain the vulnerable InetAddressMatchers class. The CVE affects InetAddressMatchers.matchInternal() and matchExternal() utilities introduced in later versions (Spring Security 5.8+). This version only has IpAddressMatcher, which matches specific IP/CIDR ranges rather than classifying addresses as internal/external. The vulnerable classification function...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-59277" }, "impact_statement": "not_affected \u2014 Spring Security 4.2.20.RELEASE does not contain the vulnerable InetAddressMatchers class. The CVE affects InetAddressMatchers.matchInternal() and matchExternal() utilities introduced in later versions (Spring Security 5.8+). This version only has IpAddressMatcher, which matches specific IP/CIDR ranges rather than classifying addresses as internal/external. The vulnerable classification function..." } ] }