{
  "@id": "urn:uuid:e79ee2a5-d877-4d43-bf5e-47b92ab792ad",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 15,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T22:52:23.660151+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-loader@3.5.16-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-loader@3.5.16-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T22:52:23.660151+00:00",
      "status_notes": "Vulnerability CVE-2024-38807 does not affect version 3.5.16-tuxcare.2 of org.springframework.boot:spring-boot-loader. not_affected \u2014 Spring Boot 3.5.16-tuxcare.9 is not affected by CVE-2024-38807. The upstream fix (commit 0b24ee857189e139f48826bf2aef10ae8680c11b) authored by Andy Wilkinson from Broadcom was already included in Spring Boot 3.5.16 before TuxCare onboarded it. The fix adds content validation when extracting certificates from nested jar files, preventing signature forgery where content signed by one party appear...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38807"
      },
      "impact_statement": "not_affected \u2014 Spring Boot 3.5.16-tuxcare.9 is not affected by CVE-2024-38807. The upstream fix (commit 0b24ee857189e139f48826bf2aef10ae8680c11b) authored by Andy Wilkinson from Broadcom was already included in Spring Boot 3.5.16 before TuxCare onboarded it. The fix adds content validation when extracting certificates from nested jar files, preventing signature forgery where content signed by one party appear..."
    }
  ]
}