{
  "@id": "urn:uuid:cfdd027b-c3cd-4dec-a1bd-546c5e646d3c",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 37,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:15:51.446651+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring@5.3.39-tuxcare.21",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring@5.3.39-tuxcare.21"
          }
        }
      ],
      "timestamp": "2026-10-30T20:32:39.227702+00:00",
      "status_notes": "Vulnerability CVE-2010-1622 does not affect version 5.3.39-tuxcare.21 of org.springframework:spring. not_affected \u2014 CVE-2010-1622 allows remote code execution via HTTP request parameters like `class.classLoader.URLs[0]=jar:...` by exploiting property binding to access ClassLoader. The vulnerability was fixed in Spring Framework commit 3a5af35d37 (May 2010) by upstream developer Juergen Hoeller. This fix was already present in the upstream Spring Framework 5.3.39 release when TuxCare onboarded it. The target ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2010-1622"
      },
      "impact_statement": "not_affected \u2014 CVE-2010-1622 allows remote code execution via HTTP request parameters like `class.classLoader.URLs[0]=jar:...` by exploiting property binding to access ClassLoader. The vulnerability was fixed in Spring Framework commit 3a5af35d37 (May 2010) by upstream developer Juergen Hoeller. This fix was already present in the upstream Spring Framework 5.3.39 release when TuxCare onboarded it. The target ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring@5.3.39-tuxcare.21",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring@5.3.39-tuxcare.21"
          }
        }
      ],
      "timestamp": "2026-10-31T21:10:00.324150+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 does not affect version 5.3.39-tuxcare.21 of org.springframework:spring. not_affected \u2014 CVE-2021-22096 affects Spring Framework 5.3.0-5.3.10, 5.2.0-5.2.17, and older versions. The target version 5.3.39 is not affected because the upstream fix (commit 99c7608ffe by Rossen Stoyanchev) was already included in the upstream Spring Framework 5.3.39 release before TuxCare onboarding. The fix sanitizes user-controlled input before logging by replacing newline characters with <EOL> and con...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22096 affects Spring Framework 5.3.0-5.3.10, 5.2.0-5.2.17, and older versions. The target version 5.3.39 is not affected because the upstream fix (commit 99c7608ffe by Rossen Stoyanchev) was already included in the upstream Spring Framework 5.3.39 release before TuxCare onboarding. The fix sanitizes user-controlled input before logging by replacing newline characters with <EOL> and con..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring@5.3.39-tuxcare.21",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring@5.3.39-tuxcare.21"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2023-20860 does not affect version 5.3.39-tuxcare.21 of org.springframework:spring. CVE-2023-20860 is not present in Spring Framework 5.3.39. The vulnerability involves pattern matching mismatch between Spring Security and Spring MVC when patterns like \"**\" lack a leading slash. The fix normalizes patterns by prepending \"/\" when missing, ensuring consistent interpretation. This fix was shipped in the upstream 5.3.39 release via commit 1cd994d3a (author: rstoyanchev@vmware.com, date: 2023-07-11), implemented in PathPatternParser.initFullPathPattern() and invoked by HandlerMappingIntrospector's match() method before pattern use.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.0.0, < 6.0.7; >= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7; >= 5.3.0, < 5.3.26), NVD (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7), cve.org (>= 6.0.0, <= 6.0.6; >= 5.3.0, <= 5.3.25), Snyk (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-20860"
      },
      "impact_statement": "CVE-2023-20860 is not present in Spring Framework 5.3.39. The vulnerability involves pattern matching mismatch between Spring Security and Spring MVC when patterns like \"**\" lack a leading slash. The fix normalizes patterns by prepending \"/\" when missing, ensuring consistent interpretation. This fix was shipped in the upstream 5.3.39 release via commit 1cd994d3a (author: rstoyanchev@vmware.com, date: 2023-07-11), implemented in PathPatternParser.initFullPathPattern() and invoked by HandlerMappingIntrospector's match() method before pattern use.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.0.0, < 6.0.7; >= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7; >= 5.3.0, < 5.3.26), NVD (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7), cve.org (>= 6.0.0, <= 6.0.6; >= 5.3.0, <= 5.3.25), Snyk (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7)."
    }
  ]
}