{
  "@id": "urn:uuid:8f3ce092-5a60-4048-88ea-4d012f20418b",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 33,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:12:34.459172+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.7.14-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.7.14-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-10-21T15:09:40.979519+00:00",
      "status_notes": "Vulnerability CVE-2007-1651 is a false positive for org.springframework.security:spring-security-oauth2-client 5.7.14-tuxcare.9. direct vulnerability is in OpenID project",
      "vulnerability": {
        "name": "CVE-2007-1651"
      },
      "impact_statement": "direct vulnerability is in OpenID project"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.7.14-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.7.14-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-10-21T15:09:40.979519+00:00",
      "status_notes": "Vulnerability CVE-2007-1652 is a false positive for org.springframework.security:spring-security-oauth2-client 5.7.14-tuxcare.9. direct vulnerability is in OpenID project",
      "vulnerability": {
        "name": "CVE-2007-1652"
      },
      "impact_statement": "direct vulnerability is in OpenID project"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.7.14-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.7.14-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2021-22119 does not affect version 5.7.14-tuxcare.9 of org.springframework.security:spring-security-oauth2-client. Spring Security 5.7.14 is not affected by CVE-2021-22119. The vulnerability allowed attackers to exhaust system resources by sending multiple OAuth2 authorization requests that accumulated unboundedly in HTTP session memory. The fix (commit 35f5ebdbcf) was already present in the upstream Spring Security 5.7.14 release that TuxCare onboarded. The defense mechanism (allowMultipleAuthorizationRequests field defaulting to false) limits storage to one authorization request per session by default, preventing the DoS attack. The vulnerable pattern (unbounded Map accumulation) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22119"
      },
      "impact_statement": "Spring Security 5.7.14 is not affected by CVE-2021-22119. The vulnerability allowed attackers to exhaust system resources by sending multiple OAuth2 authorization requests that accumulated unboundedly in HTTP session memory. The fix (commit 35f5ebdbcf) was already present in the upstream Spring Security 5.7.14 release that TuxCare onboarded. The defense mechanism (allowMultipleAuthorizationRequests field defaulting to false) limits storage to one authorization request per session by default, preventing the DoS attack. The vulnerable pattern (unbounded Map accumulation) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.7.14-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.7.14-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2022-31690 does not affect version 5.7.14-tuxcare.9 of org.springframework.security:spring-security-oauth2-client. The target Spring Security 5.7.14 is not affected by CVE-2022-31690. The vulnerability (automatic substitution of client registration scopes when Authorization Server returns empty scopes) has been fixed in all affected OAuth2 token response clients. The fix was authored by the upstream vendor (Steve Riesenberg from VMware) in commits 75004587a4 and fde26e003a, and was already included in the upstream Spring Security 5.7.14 release before TuxCare onboarded this version. All vulnerable code patterns have been removed from DefaultAuthorizationCodeTokenResponseClient, DefaultClientCredentialsTokenResponseClient, DefaultPasswordTokenResponseClient, and their reactive counterparts. The refresh token clients still substitute scopes when empty, but correctly use the previous access token's scopes (not client registration scopes), which is compliant with OAuth2 specifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), cve.org (>= 5.7, <= 5.7.4; >= 5.6, <= 5.6.8), Snyk (< 5.4.11; >= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-31690"
      },
      "impact_statement": "The target Spring Security 5.7.14 is not affected by CVE-2022-31690. The vulnerability (automatic substitution of client registration scopes when Authorization Server returns empty scopes) has been fixed in all affected OAuth2 token response clients. The fix was authored by the upstream vendor (Steve Riesenberg from VMware) in commits 75004587a4 and fde26e003a, and was already included in the upstream Spring Security 5.7.14 release before TuxCare onboarded this version. All vulnerable code patterns have been removed from DefaultAuthorizationCodeTokenResponseClient, DefaultClientCredentialsTokenResponseClient, DefaultPasswordTokenResponseClient, and their reactive counterparts. The refresh token clients still substitute scopes when empty, but correctly use the previous access token's scopes (not client registration scopes), which is compliant with OAuth2 specifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), cve.org (>= 5.7, <= 5.7.4; >= 5.6, <= 5.6.8), Snyk (< 5.4.11; >= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5)."
    }
  ]
}