{
  "@id": "urn:uuid:f3ca6edf-1f73-497b-a3d4-e84b18136da7",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 28,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:26:45.505192+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-cas@5.6.9-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-cas@5.6.9-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:26:45.505192+00:00",
      "status_notes": "Vulnerability CVE-2019-11272 does not affect version 5.6.9-tuxcare.2 of org.springframework.security:spring-security-cas. Spring Security 5.6.9 is not affected by CVE-2019-11272. The vulnerable PlaintextPasswordEncoder class was removed from Spring Security 5.x in October 2017 as part of deprecating the legacy authentication.encoding package. This removal occurred before version 5.6.9 existed and before the CVE was discovered in June 2019. The CVE only affects older versions (4.2.x and earlier) that still contained the deprecated class. The target version never had this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-11272"
      },
      "impact_statement": "Spring Security 5.6.9 is not affected by CVE-2019-11272. The vulnerable PlaintextPasswordEncoder class was removed from Spring Security 5.x in October 2017 as part of deprecating the legacy authentication.encoding package. This removal occurred before version 5.6.9 existed and before the CVE was discovered in June 2019. The CVE only affects older versions (4.2.x and earlier) that still contained the deprecated class. The target version never had this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE)."
    }
  ]
}