{
  "@id": "urn:uuid:3aa7091a-290c-4200-b7ba-35921db19cd9",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 9,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:05:53.304095+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.4.6-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.4.6-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2018-1196 does not affect version 2.4.6-tuxcare.6 of org.springframework.boot:spring-boot. not_affected \u2014 The target Spring Boot 2.4.6 repository contains the embedded launch script at spring-boot-project/spring-boot-tools/spring-boot-loader-tools/src/main/resources/org/springframework/boot/loader/tools/launch.script. Analysis of the do_start() function (lines 172-213) shows that the symlink attack vulnerability (CVE-2018-1196) has been fixed. The vulnerable pattern (unconditional chown of PID_FOLD...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1196"
      },
      "impact_statement": "not_affected \u2014 The target Spring Boot 2.4.6 repository contains the embedded launch script at spring-boot-project/spring-boot-tools/spring-boot-loader-tools/src/main/resources/org/springframework/boot/loader/tools/launch.script. Analysis of the do_start() function (lines 172-213) shows that the symlink attack vulnerability (CVE-2018-1196) has been fixed. The vulnerable pattern (unconditional chown of PID_FOLD..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.4.6-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.4.6-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2022-27772 does not affect version 2.4.6-tuxcare.6 of org.springframework.boot:spring-boot. CVE-2022-27772 affects Spring Boot versions prior to v2.2.11.RELEASE. The target version 2.4.6-tuxcare.11 contains the upstream security fix (commit 667ccdae84) that replaced the vulnerable File.createTempFile() \u2192 delete() \u2192 mkdir() pattern with secure Files.createTempDirectory() atomically creating directories with proper permissions. This fix was already present in the upstream Spring Boot 2.4.6 release before TuxCare onboarding, authored by Andy Wilkinson from Pivotal. All potentially vulnerable locations (AbstractConfigurableWebServerFactory, SpringBootMockServletContext, ApplicationTemp) use the secure pattern.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.11.RELEASE), NVD (< 2.2.11), Snyk (< 2.2.11.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-27772"
      },
      "impact_statement": "CVE-2022-27772 affects Spring Boot versions prior to v2.2.11.RELEASE. The target version 2.4.6-tuxcare.11 contains the upstream security fix (commit 667ccdae84) that replaced the vulnerable File.createTempFile() \u2192 delete() \u2192 mkdir() pattern with secure Files.createTempDirectory() atomically creating directories with proper permissions. This fix was already present in the upstream Spring Boot 2.4.6 release before TuxCare onboarding, authored by Andy Wilkinson from Pivotal. All potentially vulnerable locations (AbstractConfigurableWebServerFactory, SpringBootMockServletContext, ApplicationTemp) use the secure pattern.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.11.RELEASE), NVD (< 2.2.11), Snyk (< 2.2.11.RELEASE)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.4.6-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.4.6-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-38286 affects version 2.4.6-tuxcare.6 of org.springframework.boot:spring-boot.",
      "vulnerability": {
        "name": "CVE-2023-38286"
      },
      "action_statement": "Vulnerability CVE-2023-38286 affects version 2.4.6-tuxcare.6 of org.springframework.boot:spring-boot."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.4.6-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.4.6-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-22235 is fixed in version 2.4.6-tuxcare.6 of org.springframework.boot:spring-boot.",
      "vulnerability": {
        "name": "CVE-2025-22235"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.4.6-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.4.6-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40973 is fixed in version 2.4.6-tuxcare.6 of org.springframework.boot:spring-boot.",
      "vulnerability": {
        "name": "CVE-2026-40973"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.4.6-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.4.6-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40975 is fixed in version 2.4.6-tuxcare.6 of org.springframework.boot:spring-boot.",
      "vulnerability": {
        "name": "CVE-2026-40975"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.4.6-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.4.6-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-28T18:36:42.887038+00:00",
      "status_notes": "Vulnerability CVE-2026-40976 affects version 2.4.6-tuxcare.6 of org.springframework.boot:spring-boot.",
      "vulnerability": {
        "name": "CVE-2026-40976"
      },
      "action_statement": "Vulnerability CVE-2026-40976 affects version 2.4.6-tuxcare.6 of org.springframework.boot:spring-boot."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.4.6-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.4.6-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40977 is fixed in version 2.4.6-tuxcare.6 of org.springframework.boot:spring-boot.",
      "vulnerability": {
        "name": "CVE-2026-40977"
      }
    }
  ]
}