{
  "@id": "urn:uuid:ddc7328f-ab60-434a-a626-bd0f1847ac16",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 13,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T04:13:00.045658+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.6.15-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.6.15-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2018-1196 does not affect version 2.6.15-tuxcare.7 of org.springframework.boot:spring-boot. not_affected \u2014 CVE-2018-1196 describes a symlink attack in Spring Boot's embedded launch script where unconditional chown operations allowed the run_user to take ownership of arbitrary files. The target repository (Spring Boot 2.6.15) contains the upstream fix that was applied in commits 6ae960d295 and d59000ceb1. The launch script now checks if files/folders exist before creating them and only changes owners...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1196"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1196 describes a symlink attack in Spring Boot's embedded launch script where unconditional chown operations allowed the run_user to take ownership of arbitrary files. The target repository (Spring Boot 2.6.15) contains the upstream fix that was applied in commits 6ae960d295 and d59000ceb1. The launch script now checks if files/folders exist before creating them and only changes owners..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.6.15-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.6.15-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2022-27772 does not affect version 2.6.15-tuxcare.7 of org.springframework.boot:spring-boot. CVE-2022-27772 affects Spring Boot versions prior to v2.2.11.RELEASE due to a temporary directory hijacking vulnerability in createTempDir() method. The target version 2.6.15-tuxcare.17 is NOT vulnerable. The fix was already present in the upstream release v2.6.15 when TuxCare onboarded this version. The upstream fix (commit 667ccda by Andy Wilkinson on 2020-10-13) replaced the vulnerable File.createTempFile() \u2192 delete() \u2192 mkdir() pattern with Files.createTempDirectory(), eliminating the race condition. All three affected files (AbstractConfigurableWebServerFactory.java, ApplicationTemp.java, SpringBootMockServletContext.java) contain the fixed code using secure NIO.2 APIs with proper permissions.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.11.RELEASE), NVD (< 2.2.11), Snyk (< 2.2.11.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-27772"
      },
      "impact_statement": "CVE-2022-27772 affects Spring Boot versions prior to v2.2.11.RELEASE due to a temporary directory hijacking vulnerability in createTempDir() method. The target version 2.6.15-tuxcare.17 is NOT vulnerable. The fix was already present in the upstream release v2.6.15 when TuxCare onboarded this version. The upstream fix (commit 667ccda by Andy Wilkinson on 2020-10-13) replaced the vulnerable File.createTempFile() \u2192 delete() \u2192 mkdir() pattern with Files.createTempDirectory(), eliminating the race condition. All three affected files (AbstractConfigurableWebServerFactory.java, ApplicationTemp.java, SpringBootMockServletContext.java) contain the fixed code using secure NIO.2 APIs with proper permissions.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.11.RELEASE), NVD (< 2.2.11), Snyk (< 2.2.11.RELEASE)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.6.15-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.6.15-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-22235 is fixed in version 2.6.15-tuxcare.7 of org.springframework.boot:spring-boot.",
      "vulnerability": {
        "name": "CVE-2025-22235"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.6.15-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.6.15-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40973 affects version 2.6.15-tuxcare.7 of org.springframework.boot:spring-boot, and is fixed in 2.6.15-tuxcare.11.",
      "vulnerability": {
        "name": "CVE-2026-40973"
      },
      "action_statement": "Vulnerability CVE-2026-40973 affects version 2.6.15-tuxcare.7 of org.springframework.boot:spring-boot, and is fixed in 2.6.15-tuxcare.11."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.6.15-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.6.15-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40975 affects version 2.6.15-tuxcare.7 of org.springframework.boot:spring-boot, and is fixed in 2.6.15-tuxcare.12.",
      "vulnerability": {
        "name": "CVE-2026-40975"
      },
      "action_statement": "Vulnerability CVE-2026-40975 affects version 2.6.15-tuxcare.7 of org.springframework.boot:spring-boot, and is fixed in 2.6.15-tuxcare.12."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.6.15-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.6.15-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-10T04:13:00.045658+00:00",
      "status_notes": "Vulnerability CVE-2026-40976 does not affect version 2.6.15-tuxcare.7 of org.springframework.boot:spring-boot. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because authentication for non-health requests is unconditional, so missing health support cannot suppress it. spring-boot-project/spring-boot-actuator-autoconfigure/build.gradle:30 declares actuator, which contains HealthEndpoint, as an API dependency. spring-boot-project/spring-boot-actuator-autoconfigure/src/main/java/org/springframework/boot/actuate/autoconfigure/security/servlet/ManagementWebSecurityAutoConfiguration.java:64 requires authentication for every request outside the health matcher.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-40976"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because authentication for non-health requests is unconditional, so missing health support cannot suppress it. spring-boot-project/spring-boot-actuator-autoconfigure/build.gradle:30 declares actuator, which contains HealthEndpoint, as an API dependency. spring-boot-project/spring-boot-actuator-autoconfigure/src/main/java/org/springframework/boot/actuate/autoconfigure/security/servlet/ManagementWebSecurityAutoConfiguration.java:64 requires authentication for every request outside the health matcher."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.6.15-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.6.15-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40977 affects version 2.6.15-tuxcare.7 of org.springframework.boot:spring-boot, and is fixed in 2.6.15-tuxcare.11.",
      "vulnerability": {
        "name": "CVE-2026-40977"
      },
      "action_statement": "Vulnerability CVE-2026-40977 affects version 2.6.15-tuxcare.7 of org.springframework.boot:spring-boot, and is fixed in 2.6.15-tuxcare.11."
    }
  ]
}