{
  "@id": "urn:uuid:d12b139d-895d-4f2f-afd6-3c8c021448d0",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T02:07:50.108559+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.1.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.1.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-10T02:07:50.108559+00:00",
      "status_notes": "Vulnerability CVE-2021-22119 does not affect version 6.1.5-tuxcare.4 of org.springframework.security:spring-security-oauth2-client. The target version 6.1.5 is NOT AFFECTED by CVE-2021-22119. The vulnerability (DoS via unlimited OAuth2 authorization request accumulation in session storage) was fixed in upstream Spring Security and shipped in the 6.1.5 release that TuxCare onboarded. Both Servlet (HttpSessionOAuth2AuthorizationRequestRepository) and WebFlux (WebSessionOAuth2ServerAuthorizationRequestRepository) implementations store authorization requests as single objects, not in unbounded Maps. The fix commit 35f5ebdbcf is an ancestor of HEAD and predates the TuxCare onboarding commit 1ee981b61c.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22119"
      },
      "impact_statement": "The target version 6.1.5 is NOT AFFECTED by CVE-2021-22119. The vulnerability (DoS via unlimited OAuth2 authorization request accumulation in session storage) was fixed in upstream Spring Security and shipped in the 6.1.5 release that TuxCare onboarded. Both Servlet (HttpSessionOAuth2AuthorizationRequestRepository) and WebFlux (WebSessionOAuth2ServerAuthorizationRequestRepository) implementations store authorization requests as single objects, not in unbounded Maps. The fix commit 35f5ebdbcf is an ancestor of HEAD and predates the TuxCare onboarding commit 1ee981b61c.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.1.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.1.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-10T02:07:50.108559+00:00",
      "status_notes": "Vulnerability CVE-2022-31690 does not affect version 6.1.5-tuxcare.4 of org.springframework.security:spring-security-oauth2-client. CVE-2022-31690 does not affect Spring Security 6.1.5-tuxcare.2. The vulnerability (privilege escalation via automatic scope filling when authorization servers return empty OAuth2 scope lists) was fixed in upstream commits 75004587a4 and fde26e003a by Spring Security maintainer Steve Riesenberg, and these fixes shipped in the upstream Spring Security 6.1.5 release that TuxCare onboarded. The CVE explicitly states affected versions are \"5.7 prior to 5.7.5, and 5.6 prior to 5.6.9\" - version 6.1.5 is significantly newer and includes the upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), cve.org (>= 5.7, <= 5.7.4; >= 5.6, <= 5.6.8), Snyk (< 5.4.11; >= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-31690"
      },
      "impact_statement": "CVE-2022-31690 does not affect Spring Security 6.1.5-tuxcare.2. The vulnerability (privilege escalation via automatic scope filling when authorization servers return empty OAuth2 scope lists) was fixed in upstream commits 75004587a4 and fde26e003a by Spring Security maintainer Steve Riesenberg, and these fixes shipped in the upstream Spring Security 6.1.5 release that TuxCare onboarded. The CVE explicitly states affected versions are \"5.7 prior to 5.7.5, and 5.6 prior to 5.6.9\" - version 6.1.5 is significantly newer and includes the upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), cve.org (>= 5.7, <= 5.7.4; >= 5.6, <= 5.6.8), Snyk (< 5.4.11; >= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5)."
    }
  ]
}