{
  "@id": "urn:uuid:6a0c6274-6c7a-4652-a1f3-3ea563a9f11a",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T14:58:56.128088+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-context@5.3.30-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-context@5.3.30-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-11-02T12:39:02.394085+00:00",
      "status_notes": "Vulnerability CVE-2022-22968 does not affect version 5.3.30-tuxcare.13 of org.springframework:spring-context. not_affected \u2014 CVE-2022-22968 is NOT present in Spring Framework 5.3.30. The vulnerability involved case-sensitive pattern matching in DataBinder's disallowedFields, allowing attackers to bypass protection by capitalizing field names. The fix was already shipped in the upstream Spring Framework 5.3.30 release (commit a7cf19cec5 by sbrannen@vmware.com) before TuxCare onboarded this version. The target code at ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22968"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-22968 is NOT present in Spring Framework 5.3.30. The vulnerability involved case-sensitive pattern matching in DataBinder's disallowedFields, allowing attackers to bypass protection by capitalizing field names. The fix was already shipped in the upstream Spring Framework 5.3.30 release (commit a7cf19cec5 by sbrannen@vmware.com) before TuxCare onboarded this version. The target code at ..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-context@5.3.30-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-context@5.3.30-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-11-02T12:39:02.394085+00:00",
      "status_notes": "Vulnerability CVE-2024-38820 is fixed in version 5.3.30-tuxcare.13 of org.springframework:spring-context.",
      "vulnerability": {
        "name": "CVE-2024-38820"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-context@5.3.30-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-context@5.3.30-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-11-02T12:39:02.394085+00:00",
      "status_notes": "Vulnerability CVE-2025-22233 is fixed in version 5.3.30-tuxcare.13 of org.springframework:spring-context.",
      "vulnerability": {
        "name": "CVE-2025-22233"
      }
    }
  ]
}