{
  "@id": "urn:uuid:faa7f514-be96-4072-a8b6-dd4184199ee2",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 13,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T20:55:00.104909+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.7.18-tuxcare.17",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.7.18-tuxcare.17"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2018-1196 does not affect version 2.7.18-tuxcare.17 of org.springframework.boot:spring-boot. not_affected \u2014 CVE-2018-1196 describes a symlink attack in Spring Boot's embedded launch script where the run_user could create symlinks at PID folder/file or log file locations, and the script would follow them during chown operations, enabling arbitrary file ownership takeover. The target repository (Spring Boot 2.7.18-tuxcare.23) contains the complete upstream fix in launch.script lines 178-189, which guar...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1196"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1196 describes a symlink attack in Spring Boot's embedded launch script where the run_user could create symlinks at PID folder/file or log file locations, and the script would follow them during chown operations, enabling arbitrary file ownership takeover. The target repository (Spring Boot 2.7.18-tuxcare.23) contains the complete upstream fix in launch.script lines 178-189, which guar..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.7.18-tuxcare.17",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.7.18-tuxcare.17"
          }
        }
      ],
      "timestamp": "2026-11-04T09:04:11.456857+00:00",
      "status_notes": "Vulnerability CVE-2022-27772 does not affect version 2.7.18-tuxcare.17 of org.springframework.boot:spring-boot. CVE-2022-27772 (temporary directory hijacking via race condition) is NOT present in Spring Boot 2.7.18-tuxcare.23. The vulnerable create-file\u2192delete\u2192mkdir pattern was replaced with secure Files.createTempDirectory() API in upstream commit 667ccdae84 (Oct 2020, v2.2.11.RELEASE) by Andy Wilkinson. This fix was already present in the upstream release before TuxCare's first commit (5d325d76ac \"Basic tuxcare setup\"). All affected files (AbstractConfigurableWebServerFactory.java, SpringBootMockServletContext.java, ApplicationTemp.java) use the secure atomic directory creation API. Repository-wide search confirms zero instances of the vulnerable delete\u2192mkdir sequence.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.11.RELEASE), NVD (< 2.2.11), Snyk (< 2.2.11.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-27772"
      },
      "impact_statement": "CVE-2022-27772 (temporary directory hijacking via race condition) is NOT present in Spring Boot 2.7.18-tuxcare.23. The vulnerable create-file\u2192delete\u2192mkdir pattern was replaced with secure Files.createTempDirectory() API in upstream commit 667ccdae84 (Oct 2020, v2.2.11.RELEASE) by Andy Wilkinson. This fix was already present in the upstream release before TuxCare's first commit (5d325d76ac \"Basic tuxcare setup\"). All affected files (AbstractConfigurableWebServerFactory.java, SpringBootMockServletContext.java, ApplicationTemp.java) use the secure atomic directory creation API. Repository-wide search confirms zero instances of the vulnerable delete\u2192mkdir sequence.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.11.RELEASE), NVD (< 2.2.11), Snyk (< 2.2.11.RELEASE)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.7.18-tuxcare.17",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.7.18-tuxcare.17"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-38286 is fixed in version 2.7.18-tuxcare.17 of org.springframework.boot:spring-boot.",
      "vulnerability": {
        "name": "CVE-2023-38286"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.7.18-tuxcare.17",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.7.18-tuxcare.17"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-22235 is fixed in version 2.7.18-tuxcare.17 of org.springframework.boot:spring-boot.",
      "vulnerability": {
        "name": "CVE-2025-22235"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.7.18-tuxcare.17",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.7.18-tuxcare.17"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40973 is fixed in version 2.7.18-tuxcare.17 of org.springframework.boot:spring-boot.",
      "vulnerability": {
        "name": "CVE-2026-40973"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.7.18-tuxcare.17",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.7.18-tuxcare.17"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40975 is fixed in version 2.7.18-tuxcare.17 of org.springframework.boot:spring-boot.",
      "vulnerability": {
        "name": "CVE-2026-40975"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.7.18-tuxcare.17",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.7.18-tuxcare.17"
          }
        }
      ],
      "timestamp": "2026-11-09T20:55:00.104909+00:00",
      "status_notes": "Vulnerability CVE-2026-40976 does not affect version 2.7.18-tuxcare.17 of org.springframework.boot:spring-boot. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. Actuator-autoconfigure requires actuator through build.gradle:20, which contains HealthEndpoint.java:42. The management configuration activates for servlet applications using default security (ManagementWebSecurityAutoConfiguration.java:54). It permits health requests, unconditionally requires authentication for every remaining request, and builds the chain; the vulnerable conditional omission is absent (ManagementWebSecurityAutoConfiguration.java:62). Even a hypothetical bean-creation failure would enter startup failure handling and close the context, rather than establish the claimed permissive application (SpringApplication.java:317, SpringApplication.java:784).",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-40976"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. Actuator-autoconfigure requires actuator through build.gradle:20, which contains HealthEndpoint.java:42. The management configuration activates for servlet applications using default security (ManagementWebSecurityAutoConfiguration.java:54). It permits health requests, unconditionally requires authentication for every remaining request, and builds the chain; the vulnerable conditional omission is absent (ManagementWebSecurityAutoConfiguration.java:62). Even a hypothetical bean-creation failure would enter startup failure handling and close the context, rather than establish the claimed permissive application (SpringApplication.java:317, SpringApplication.java:784)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.7.18-tuxcare.17",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.7.18-tuxcare.17"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40977 is fixed in version 2.7.18-tuxcare.17 of org.springframework.boot:spring-boot.",
      "vulnerability": {
        "name": "CVE-2026-40977"
      }
    }
  ]
}