{
  "@id": "urn:uuid:91fc1a44-48df-4c85-bcea-1ad6798e4436",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T13:26:18.730326+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.7.9-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.7.9-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T13:26:18.730326+00:00",
      "status_notes": "Vulnerability CVE-2018-1196 does not affect version 2.7.9-tuxcare.3 of org.springframework.boot:spring-boot. not_affected \u2014 The target Spring Boot 2.7.9 is not affected by CVE-2018-1196. The symlink attack vulnerability in the embedded launch script was fixed by upstream Spring Boot developers in January-February 2018 (commits 9b8cb9a463 and d59000ceb1), first appearing in Spring Boot v1.5.10.RELEASE and v2.0.0.RC2. The target version 2.7.9 (released February 2023) shipped with these fixes already applied, over 5 ye...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1196"
      },
      "impact_statement": "not_affected \u2014 The target Spring Boot 2.7.9 is not affected by CVE-2018-1196. The symlink attack vulnerability in the embedded launch script was fixed by upstream Spring Boot developers in January-February 2018 (commits 9b8cb9a463 and d59000ceb1), first appearing in Spring Boot v1.5.10.RELEASE and v2.0.0.RC2. The target version 2.7.9 (released February 2023) shipped with these fixes already applied, over 5 ye..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.7.9-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.7.9-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T13:26:18.730326+00:00",
      "status_notes": "Vulnerability CVE-2022-27772 does not affect version 2.7.9-tuxcare.3 of org.springframework.boot:spring-boot. Target Spring Boot 2.7.9-tuxcare.1 is NOT AFFECTED by CVE-2022-27772 (temporary directory hijacking). The vulnerable code pattern (File.createTempFile + delete + mkdir race condition) was fixed by upstream Spring Boot in version 2.2.11.RELEASE (October 2020, commit 667ccdae84 by Andy Wilkinson). The target version 2.7.9 (released January 2023) is based on an already-fixed upstream release. The fix uses Files.createTempDirectory() for atomic, secure directory creation, eliminating the race window that allowed attackers to substitute their own directories in shared temporary storage.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.11.RELEASE), NVD (< 2.2.11), Snyk (< 2.2.11.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-27772"
      },
      "impact_statement": "Target Spring Boot 2.7.9-tuxcare.1 is NOT AFFECTED by CVE-2022-27772 (temporary directory hijacking). The vulnerable code pattern (File.createTempFile + delete + mkdir race condition) was fixed by upstream Spring Boot in version 2.2.11.RELEASE (October 2020, commit 667ccdae84 by Andy Wilkinson). The target version 2.7.9 (released January 2023) is based on an already-fixed upstream release. The fix uses Files.createTempDirectory() for atomic, secure directory creation, eliminating the race window that allowed attackers to substitute their own directories in shared temporary storage.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.11.RELEASE), NVD (< 2.2.11), Snyk (< 2.2.11.RELEASE)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.7.9-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.7.9-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T13:26:18.730326+00:00",
      "status_notes": "Vulnerability CVE-2025-22235 is fixed in version 2.7.9-tuxcare.3 of org.springframework.boot:spring-boot.",
      "vulnerability": {
        "name": "CVE-2025-22235"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.7.9-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.7.9-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T13:26:18.730326+00:00",
      "status_notes": "Vulnerability CVE-2026-40973 is fixed in version 2.7.9-tuxcare.3 of org.springframework.boot:spring-boot.",
      "vulnerability": {
        "name": "CVE-2026-40973"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.7.9-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.7.9-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T13:26:18.730326+00:00",
      "status_notes": "Vulnerability CVE-2026-40975 is fixed in version 2.7.9-tuxcare.3 of org.springframework.boot:spring-boot.",
      "vulnerability": {
        "name": "CVE-2026-40975"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.7.9-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.7.9-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T13:26:18.730326+00:00",
      "status_notes": "Vulnerability CVE-2026-40976 affects version 2.7.9-tuxcare.3 of org.springframework.boot:spring-boot.",
      "vulnerability": {
        "name": "CVE-2026-40976"
      },
      "action_statement": "Vulnerability CVE-2026-40976 affects version 2.7.9-tuxcare.3 of org.springframework.boot:spring-boot."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@2.7.9-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@2.7.9-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T13:26:18.730326+00:00",
      "status_notes": "Vulnerability CVE-2026-40977 is fixed in version 2.7.9-tuxcare.3 of org.springframework.boot:spring-boot.",
      "vulnerability": {
        "name": "CVE-2026-40977"
      }
    }
  ]
}