{
  "@id": "urn:uuid:dac1eddf-f10c-4de8-bab2-e86a0b5e61a9",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 13,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T04:13:00.045658+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@3.3.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@3.3.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2018-1196 does not affect version 3.3.13-tuxcare.3 of org.springframework.boot:spring-boot. not_affected \u2014 The target Spring Boot 3.3.13 repository is NOT AFFECTED by CVE-2018-1196. The symlink attack vulnerability was fixed in upstream Spring Boot by commit 6ae960d295 (authored by Phillip Webb, pwebb@pivotal.io) and shipped in Spring Boot 3.3.0. The fix was already present when TuxCare onboarded version 3.3.13. The launch.script file contains the necessary defenses: it checks whether PID folders, P...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1196"
      },
      "impact_statement": "not_affected \u2014 The target Spring Boot 3.3.13 repository is NOT AFFECTED by CVE-2018-1196. The symlink attack vulnerability was fixed in upstream Spring Boot by commit 6ae960d295 (authored by Phillip Webb, pwebb@pivotal.io) and shipped in Spring Boot 3.3.0. The fix was already present when TuxCare onboarded version 3.3.13. The launch.script file contains the necessary defenses: it checks whether PID folders, P..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@3.3.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@3.3.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2022-27772 does not affect version 3.3.13-tuxcare.3 of org.springframework.boot:spring-boot. The target spring-boot 3.3.13-tuxcare.18 is not affected by CVE-2022-27772. The vulnerable temporary directory hijacking pattern (File.createTempFile\u2192delete\u2192mkdir race condition) is not present in the code. The upstream Spring Boot project fixed this in v2.2.11.RELEASE (October 2020, commit 667ccdae84 by Andy Wilkinson), replacing the insecure sequence with atomic Files.createTempDirectory(). This fix was already in the upstream release when TuxCare onboarded version 3.3.13, so the vulnerable code never existed in this target version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.11.RELEASE), NVD (< 2.2.11), Snyk (< 2.2.11.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-27772"
      },
      "impact_statement": "The target spring-boot 3.3.13-tuxcare.18 is not affected by CVE-2022-27772. The vulnerable temporary directory hijacking pattern (File.createTempFile\u2192delete\u2192mkdir race condition) is not present in the code. The upstream Spring Boot project fixed this in v2.2.11.RELEASE (October 2020, commit 667ccdae84 by Andy Wilkinson), replacing the insecure sequence with atomic Files.createTempDirectory(). This fix was already in the upstream release when TuxCare onboarded version 3.3.13, so the vulnerable code never existed in this target version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.11.RELEASE), NVD (< 2.2.11), Snyk (< 2.2.11.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@3.3.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@3.3.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-22235 does not affect version 3.3.13-tuxcare.3 of org.springframework.boot:spring-boot. This CVE was fixed in version 3.3.11 (https://security.snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORKBOOT-9804539, https://github.com/advisories/GHSA-rc42-6c7j-7h5r) so version 3.3.13 is not affected",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22235"
      },
      "impact_statement": "This CVE was fixed in version 3.3.11 (https://security.snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORKBOOT-9804539, https://github.com/advisories/GHSA-rc42-6c7j-7h5r) so version 3.3.13 is not affected"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@3.3.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@3.3.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40973 affects version 3.3.13-tuxcare.3 of org.springframework.boot:spring-boot, and is fixed in 3.3.13-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-40973"
      },
      "action_statement": "Vulnerability CVE-2026-40973 affects version 3.3.13-tuxcare.3 of org.springframework.boot:spring-boot, and is fixed in 3.3.13-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@3.3.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@3.3.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40975 affects version 3.3.13-tuxcare.3 of org.springframework.boot:spring-boot, and is fixed in 3.3.13-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-40975"
      },
      "action_statement": "Vulnerability CVE-2026-40975 affects version 3.3.13-tuxcare.3 of org.springframework.boot:spring-boot, and is fixed in 3.3.13-tuxcare.4."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@3.3.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@3.3.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-10T04:13:00.045658+00:00",
      "status_notes": "Vulnerability CVE-2026-40976 does not affect version 3.3.13-tuxcare.3 of org.springframework.boot:spring-boot. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because its default security filter chain always requires authentication for requests outside the permitted health endpoint, with no health-presence check that could skip authorization. In spring-boot-project/spring-boot-actuator-autoconfigure/src/main/java/org/springframework/boot/actuate/autoconfigure/security/servlet/ManagementWebSecurityAutoConfiguration.java:61, the filter-chain bean unconditionally registers anyRequest().authenticated() and builds the chain.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-40976"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because its default security filter chain always requires authentication for requests outside the permitted health endpoint, with no health-presence check that could skip authorization. In spring-boot-project/spring-boot-actuator-autoconfigure/src/main/java/org/springframework/boot/actuate/autoconfigure/security/servlet/ManagementWebSecurityAutoConfiguration.java:61, the filter-chain bean unconditionally registers anyRequest().authenticated() and builds the chain."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@3.3.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@3.3.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40977 affects version 3.3.13-tuxcare.3 of org.springframework.boot:spring-boot, and is fixed in 3.3.13-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-40977"
      },
      "action_statement": "Vulnerability CVE-2026-40977 affects version 3.3.13-tuxcare.3 of org.springframework.boot:spring-boot, and is fixed in 3.3.13-tuxcare.4."
    }
  ]
}