{
  "@id": "urn:uuid:4e742ec8-3d48-4f37-b862-7d50f76abaf8",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 8,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:02:00.202619+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-function-parent@4.3.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-function-parent@4.3.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:02:00.202619+00:00",
      "status_notes": "Vulnerability CVE-2022-22979 does not affect version 4.3.4-tuxcare.1 of org.springframework.cloud:spring-cloud-function-parent. The target repository (spring-cloud-function 4.3.4) is NOT AFFECTED by CVE-2022-22979. The vulnerability fixes for the denial-of-service condition due to concurrent function lookup/registration were already present in the upstream 4.3.4 release that TuxCare onboarded. Two key upstream commits address the vulnerability: (1) commit 90c3dbdd adds synchronized locking via lookupLock in BeanFactoryAwareFunctionRegistry.lookup() to prevent concurrent duplicate registrations, and (2) commit b3f564b40 adds isFunctionDefinitionEligible() filtering to reject ineligible function definitions. Both commits are authored by upstream (ozhurakousky@vmware.com) and were included in the upstream release before TuxCare's onboarding commit 5eb6737f.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.6), NVD (< 3.2.6), cve.org (< 3.2.6), Snyk (< 3.2.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22979"
      },
      "impact_statement": "The target repository (spring-cloud-function 4.3.4) is NOT AFFECTED by CVE-2022-22979. The vulnerability fixes for the denial-of-service condition due to concurrent function lookup/registration were already present in the upstream 4.3.4 release that TuxCare onboarded. Two key upstream commits address the vulnerability: (1) commit 90c3dbdd adds synchronized locking via lookupLock in BeanFactoryAwareFunctionRegistry.lookup() to prevent concurrent duplicate registrations, and (2) commit b3f564b40 adds isFunctionDefinitionEligible() filtering to reject ineligible function definitions. Both commits are authored by upstream (ozhurakousky@vmware.com) and were included in the upstream release before TuxCare's onboarding commit 5eb6737f.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.6), NVD (< 3.2.6), cve.org (< 3.2.6), Snyk (< 3.2.6)."
    }
  ]
}