{
  "@id": "urn:uuid:978cddd4-75b3-4511-badd-cc470eb0c2eb",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 18,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:43:54.437566+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-bom@6.4.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-bom@6.4.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:43:54.437566+00:00",
      "status_notes": "Vulnerability CVE-2021-22112 does not affect version 6.4.3-tuxcare.2 of org.springframework.security:spring-security-bom. CVE-2021-22112 affects Spring Security versions 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8, 5.2.x prior to 5.2.9, and older. The vulnerability allows SecurityContext to fail saving when changed multiple times in a single request, enabling privilege escalation. The target version 6.4.3 is NOT AFFECTED because the upstream fix (commit 38e9e8ca52 by Rob Winch, Jan 2021) was already included in the Spring Security 6.4.3 release that TuxCare onboarded. The vulnerable pattern (one-save-per-request guard) has been removed and the fix (isSaveContextInvoked flag enabling multiple saves) is present in HttpSessionSecurityContextRepository.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22112"
      },
      "impact_statement": "CVE-2021-22112 affects Spring Security versions 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8, 5.2.x prior to 5.2.9, and older. The vulnerability allows SecurityContext to fail saving when changed multiple times in a single request, enabling privilege escalation. The target version 6.4.3 is NOT AFFECTED because the upstream fix (commit 38e9e8ca52 by Rob Winch, Jan 2021) was already included in the Spring Security 6.4.3 release that TuxCare onboarded. The vulnerable pattern (one-save-per-request guard) has been removed and the fix (isSaveContextInvoked flag enabling multiple saves) is present in HttpSessionSecurityContextRepository.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE)."
    }
  ]
}