{
  "@id": "urn:uuid:1d68bdb9-2007-4fda-837e-e516773d64a4",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 6,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T18:11:17.130919+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.ldap/spring-ldap-core@3.2.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.ldap/spring-ldap-core@3.2.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T18:11:17.130919+00:00",
      "status_notes": "Vulnerability CVE-2017-8028 does not affect version 3.2.12-tuxcare.2 of org.springframework.ldap:spring-ldap-core. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 3.2.12 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-pjqh-2jcc-5j84 (affected up to 2.3.2), NVD (affected up to 2.3.1), Snyk (affected up to 2.3.2.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-8028"
      },
      "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 3.2.12 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-pjqh-2jcc-5j84 (affected up to 2.3.2), NVD (affected up to 2.3.1), Snyk (affected up to 2.3.2.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.ldap/spring-ldap-core@3.2.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.ldap/spring-ldap-core@3.2.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2024-38829 does not affect version 3.2.12-tuxcare.2 of org.springframework.ldap:spring-ldap-core. not_affected \u2014 The target Spring LDAP 3.2.12-tuxcare.4 is not affected by CVE-2024-38829. The vulnerability pattern (locale-dependent toLowerCase()/toUpperCase() calls without explicit Locale parameter) is not present in the target code. All affected files already use Locale.ROOT for case conversion operations. The fix was authored by Josh Cummings (upstream Spring maintainer) and shipped in the upstream Spri...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38829"
      },
      "impact_statement": "not_affected \u2014 The target Spring LDAP 3.2.12-tuxcare.4 is not affected by CVE-2024-38829. The vulnerability pattern (locale-dependent toLowerCase()/toUpperCase() calls without explicit Locale parameter) is not present in the target code. All affected files already use Locale.ROOT for case conversion operations. The fix was authored by Josh Cummings (upstream Spring maintainer) and shipped in the upstream Spri..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.ldap/spring-ldap-core@3.2.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.ldap/spring-ldap-core@3.2.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41720 is fixed in version 3.2.12-tuxcare.2 of org.springframework.ldap:spring-ldap-core.",
      "vulnerability": {
        "name": "CVE-2026-41720"
      }
    }
  ]
}