{
  "@id": "urn:uuid:a5c5055a-4078-41e6-859b-23d598828ecb",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 8,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T16:42:00.216861+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.1.8.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.1.8.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2018-1196 does not affect version 2.1.8.RELEASE-tuxcare.1 of org.springframework.boot:spring-boot. not_affected \u2014 The target Spring Boot 2.1.8.RELEASE is not affected by CVE-2018-1196. The vulnerability involved a symlink attack in the embedded launch script where unconditional chown operations allowed the run_user to gain ownership of arbitrary files. The fix (commit 9b8cb9a463 from January 2018) was already present in the upstream Spring Boot 2.1.8.RELEASE when TuxCare onboarded it. The launch script now...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1196"
      },
      "impact_statement": "not_affected \u2014 The target Spring Boot 2.1.8.RELEASE is not affected by CVE-2018-1196. The vulnerability involved a symlink attack in the embedded launch script where unconditional chown operations allowed the run_user to gain ownership of arbitrary files. The fix (commit 9b8cb9a463 from January 2018) was already present in the upstream Spring Boot 2.1.8.RELEASE when TuxCare onboarded it. The launch script now..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.1.8.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.1.8.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-27772 is fixed in version 2.1.8.RELEASE-tuxcare.1 of org.springframework.boot:spring-boot.",
      "vulnerability": {
        "name": "CVE-2022-27772"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.1.8.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.1.8.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-22235 is fixed in version 2.1.8.RELEASE-tuxcare.1 of org.springframework.boot:spring-boot.",
      "vulnerability": {
        "name": "CVE-2025-22235"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.1.8.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.1.8.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40973 is fixed in version 2.1.8.RELEASE-tuxcare.1 of org.springframework.boot:spring-boot.",
      "vulnerability": {
        "name": "CVE-2026-40973"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.1.8.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.1.8.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40975 affects version 2.1.8.RELEASE-tuxcare.1 of org.springframework.boot:spring-boot.",
      "vulnerability": {
        "name": "CVE-2026-40975"
      },
      "action_statement": "Vulnerability CVE-2026-40975 affects version 2.1.8.RELEASE-tuxcare.1 of org.springframework.boot:spring-boot."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.1.8.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.1.8.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T18:36:42.887038+00:00",
      "status_notes": "Vulnerability CVE-2026-40976 affects version 2.1.8.RELEASE-tuxcare.1 of org.springframework.boot:spring-boot.",
      "vulnerability": {
        "name": "CVE-2026-40976"
      },
      "action_statement": "Vulnerability CVE-2026-40976 affects version 2.1.8.RELEASE-tuxcare.1 of org.springframework.boot:spring-boot."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.1.8.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.1.8.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40977 affects version 2.1.8.RELEASE-tuxcare.1 of org.springframework.boot:spring-boot.",
      "vulnerability": {
        "name": "CVE-2026-40977"
      },
      "action_statement": "Vulnerability CVE-2026-40977 affects version 2.1.8.RELEASE-tuxcare.1 of org.springframework.boot:spring-boot."
    }
  ]
}