{
  "@id": "urn:uuid:8a06e561-bfeb-40c2-a221-198927d44e92",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 35,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:12:34.459172+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2021-22119 does not affect version 6.2.8-tuxcare.1 of org.springframework.security:spring-security-oauth2-client. CVE-2021-22119 affects Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10, and 5.2.x prior to 5.2.11. The target version 6.2.8 is not affected. The vulnerable pattern (Map-based accumulation of OAuth2 authorization requests in session storage) is not present. The fix was already included in the upstream Spring Security 6.2.8 release that TuxCare onboarded. Both servlet (HttpSessionOAuth2AuthorizationRequestRepository) and reactive (WebSessionOAuth2ServerAuthorizationRequestRepository) implementations store only ONE authorization request per session by directly setting the session attribute, overwriting any previous request. This prevents the DoS attack vector of unbounded memory consumption.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22119"
      },
      "impact_statement": "CVE-2021-22119 affects Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10, and 5.2.x prior to 5.2.11. The target version 6.2.8 is not affected. The vulnerable pattern (Map-based accumulation of OAuth2 authorization requests in session storage) is not present. The fix was already included in the upstream Spring Security 6.2.8 release that TuxCare onboarded. Both servlet (HttpSessionOAuth2AuthorizationRequestRepository) and reactive (WebSessionOAuth2ServerAuthorizationRequestRepository) implementations store only ONE authorization request per session by directly setting the session attribute, overwriting any previous request. This prevents the DoS attack vector of unbounded memory consumption.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2022-31690 does not affect version 6.2.8-tuxcare.1 of org.springframework.security:spring-security-oauth2-client. CVE-2022-31690 privilege escalation vulnerability is NOT present in Spring Security 6.2.8. The vulnerable pattern (automatic scope defaulting when OAuth2 authorization server returns empty scopes) was fixed by upstream Spring Security in October 2022 (commits 75004587a419 and fde26e003a64) and shipped in the 6.2.8 release (November 2024). The fix removes the logic that would replace empty scopes with all requested scopes, preventing privilege escalation. Target version 6.2.8 is also much newer than the affected versions listed in the CVE (5.6.x prior to 5.6.9, 5.7.x prior to 5.7.5).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), cve.org (>= 5.7, <= 5.7.4; >= 5.6, <= 5.6.8), Snyk (< 5.4.11; >= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-31690"
      },
      "impact_statement": "CVE-2022-31690 privilege escalation vulnerability is NOT present in Spring Security 6.2.8. The vulnerable pattern (automatic scope defaulting when OAuth2 authorization server returns empty scopes) was fixed by upstream Spring Security in October 2022 (commits 75004587a419 and fde26e003a64) and shipped in the 6.2.8 release (November 2024). The fix removes the logic that would replace empty scopes with all requested scopes, preventing privilege escalation. Target version 6.2.8 is also much newer than the affected versions listed in the CVE (5.6.x prior to 5.6.9, 5.7.x prior to 5.7.5).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), cve.org (>= 5.7, <= 5.7.4; >= 5.6, <= 5.6.8), Snyk (< 5.4.11; >= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5)."
    }
  ]
}