{
  "@id": "urn:uuid:a0eca9df-bc46-4b2f-9681-211acf2bf0bc",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 14,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:05:53.304095+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@3.0.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@3.0.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2018-1196 does not affect version 3.0.13-tuxcare.2 of org.springframework.boot:spring-boot. not_affected \u2014 Spring Boot 3.0.13 is NOT affected by CVE-2018-1196. The symlink attack vulnerability was fixed upstream by Pivotal in January 2018 (commit 9b8cb9a463) and was already present in the 3.0.13 release. The launch.script file contains the required existence checks that prevent unconditional chown operations on potentially symlinked paths. This is an upstream fix that shipped with the base version, ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1196"
      },
      "impact_statement": "not_affected \u2014 Spring Boot 3.0.13 is NOT affected by CVE-2018-1196. The symlink attack vulnerability was fixed upstream by Pivotal in January 2018 (commit 9b8cb9a463) and was already present in the 3.0.13 release. The launch.script file contains the required existence checks that prevent unconditional chown operations on potentially symlinked paths. This is an upstream fix that shipped with the base version, ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@3.0.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@3.0.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2022-27772 does not affect version 3.0.13-tuxcare.2 of org.springframework.boot:spring-boot. CVE-2022-27772 (temporary directory hijacking race condition) is NOT present in Spring Boot 3.0.13. The vulnerable pattern (File.createTempFile \u2192 delete \u2192 mkdir) was replaced with the secure Files.createTempDirectory() method in upstream commit 667ccdae84 by Andy Wilkinson (Pivotal). This fix was already included in Spring Boot 3.0.13 when TuxCare onboarded the version. All three affected files (AbstractConfigurableWebServerFactory.java, ApplicationTemp.java, SpringBootMockServletContext.java) contain the fixed code that atomically creates directories with secure permissions, eliminating the race window where an attacker could substitute their own directory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.11.RELEASE), NVD (< 2.2.11), Snyk (< 2.2.11.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-27772"
      },
      "impact_statement": "CVE-2022-27772 (temporary directory hijacking race condition) is NOT present in Spring Boot 3.0.13. The vulnerable pattern (File.createTempFile \u2192 delete \u2192 mkdir) was replaced with the secure Files.createTempDirectory() method in upstream commit 667ccdae84 by Andy Wilkinson (Pivotal). This fix was already included in Spring Boot 3.0.13 when TuxCare onboarded the version. All three affected files (AbstractConfigurableWebServerFactory.java, ApplicationTemp.java, SpringBootMockServletContext.java) contain the fixed code that atomically creates directories with secure permissions, eliminating the race window where an attacker could substitute their own directory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.11.RELEASE), NVD (< 2.2.11), Snyk (< 2.2.11.RELEASE)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@3.0.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@3.0.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-22235 is fixed in version 3.0.13-tuxcare.2 of org.springframework.boot:spring-boot.",
      "vulnerability": {
        "name": "CVE-2025-22235"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@3.0.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@3.0.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T18:36:42.887038+00:00",
      "status_notes": "Vulnerability CVE-2026-40973 affects version 3.0.13-tuxcare.2 of org.springframework.boot:spring-boot.",
      "vulnerability": {
        "name": "CVE-2026-40973"
      },
      "action_statement": "Vulnerability CVE-2026-40973 affects version 3.0.13-tuxcare.2 of org.springframework.boot:spring-boot."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@3.0.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@3.0.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-13T17:18:00.098046+00:00",
      "status_notes": "Vulnerability CVE-2026-40975 affects version 3.0.13-tuxcare.2 of org.springframework.boot:spring-boot.",
      "vulnerability": {
        "name": "CVE-2026-40975"
      },
      "action_statement": "Vulnerability CVE-2026-40975 affects version 3.0.13-tuxcare.2 of org.springframework.boot:spring-boot."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@3.0.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@3.0.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T18:36:42.887038+00:00",
      "status_notes": "Vulnerability CVE-2026-40976 affects version 3.0.13-tuxcare.2 of org.springframework.boot:spring-boot.",
      "vulnerability": {
        "name": "CVE-2026-40976"
      },
      "action_statement": "Vulnerability CVE-2026-40976 affects version 3.0.13-tuxcare.2 of org.springframework.boot:spring-boot."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@3.0.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@3.0.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-13T17:19:00.186723+00:00",
      "status_notes": "Vulnerability CVE-2026-40977 affects version 3.0.13-tuxcare.2 of org.springframework.boot:spring-boot.",
      "vulnerability": {
        "name": "CVE-2026-40977"
      },
      "action_statement": "Vulnerability CVE-2026-40977 affects version 3.0.13-tuxcare.2 of org.springframework.boot:spring-boot."
    }
  ]
}