{
  "@id": "urn:uuid:32e101b5-eee3-4950-82b9-9c891abd0b16",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 32,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:50:03.446715+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-cas@4.2.20.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-cas@4.2.20.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2007-1651 does not affect version 4.2.20.RELEASE-tuxcare.2 of org.springframework.security:spring-security-cas. Version 4.2.20.RELEASE is not vulnerable. Summary: The target repository is NOT VULNERABLE to CVE-2007-1651. The security fix has already been applied.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2007-1651"
      },
      "impact_statement": "Version 4.2.20.RELEASE is not vulnerable. Summary: The target repository is NOT VULNERABLE to CVE-2007-1651. The security fix has already been applied."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-cas@4.2.20.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-cas@4.2.20.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2007-1652 does not affect version 4.2.20.RELEASE-tuxcare.2 of org.springframework.security:spring-security-cas. Version 4.2.20.RELEASE is not vulnerable. Summary: The target repository is NOT VULNERABLE to CVE-2007-1652. The security fix has already been applied. The code contains the necessary null check for DiscoveryInformation that prevents replay attacks and session-based exploitation.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2007-1652"
      },
      "impact_statement": "Version 4.2.20.RELEASE is not vulnerable. Summary: The target repository is NOT VULNERABLE to CVE-2007-1652. The security fix has already been applied. The code contains the necessary null check for DiscoveryInformation that prevents replay attacks and session-based exploitation."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-cas@4.2.20.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-cas@4.2.20.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:23:26.744347+00:00",
      "status_notes": "Vulnerability CVE-2019-11272 does not affect version 4.2.20.RELEASE-tuxcare.2 of org.springframework.security:spring-security-cas. CVE-2019-11272 is not present in Spring Security 4.2.20.RELEASE. The vulnerability (null password bypass in PlaintextPasswordEncoder) was fixed in upstream commit b2d4fec3617c497c5a8eb9c7e5270e0c7db293ee by Rob Winch, which was already included in the upstream release before TuxCare onboarded this version. The fix adds a null check at line 54-56 that immediately returns false when encPass is null, preventing authentication bypass. Since this was an upstream fix present in the base release (before first TuxCare commit a868dcdcca7948205d78e9d4ff32b7fdb273217b), the vulnerable pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-11272"
      },
      "impact_statement": "CVE-2019-11272 is not present in Spring Security 4.2.20.RELEASE. The vulnerability (null password bypass in PlaintextPasswordEncoder) was fixed in upstream commit b2d4fec3617c497c5a8eb9c7e5270e0c7db293ee by Rob Winch, which was already included in the upstream release before TuxCare onboarded this version. The fix adds a null check at line 54-56 that immediately returns false when encPass is null, preventing authentication bypass. Since this was an upstream fix present in the base release (before first TuxCare commit a868dcdcca7948205d78e9d4ff32b7fdb273217b), the vulnerable pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE)."
    }
  ]
}