{
  "@id": "urn:uuid:63b68e22-36dd-4775-81d0-99f6575b4e52",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 18,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:26:45.505192+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-cas@5.7.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-cas@5.7.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T12:26:45.505192+00:00",
      "status_notes": "Vulnerability CVE-2019-11272 does not affect version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-cas. Spring Security 5.7.7 is NOT AFFECTED by CVE-2019-11272. The vulnerable class PlaintextPasswordEncoder was removed entirely from Spring Security in upstream version 5.0.0.RC1 (October 2017), well before the target version 5.7.7 was released. The CVE describes a null-handling flaw in PlaintextPasswordEncoder.isPasswordValid() that allowed authentication with password \"null\" when a user had a null encoded password. Since this class does not exist in 5.7.7, the vulnerability pattern cannot manifest. The removal was performed by upstream (Rob Winch) and shipped in the upstream 5.7.7 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-11272"
      },
      "impact_statement": "Spring Security 5.7.7 is NOT AFFECTED by CVE-2019-11272. The vulnerable class PlaintextPasswordEncoder was removed entirely from Spring Security in upstream version 5.0.0.RC1 (October 2017), well before the target version 5.7.7 was released. The CVE describes a null-handling flaw in PlaintextPasswordEncoder.isPasswordValid() that allowed authentication with password \"null\" when a user had a null encoded password. Since this class does not exist in 5.7.7, the vulnerability pattern cannot manifest. The removal was performed by upstream (Rob Winch) and shipped in the upstream 5.7.7 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE)."
    }
  ]
}