{
  "@id": "urn:uuid:5afd5bd1-c4b7-4020-9f99-7d1e64c13dba",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 34,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:22:29.685630+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-cas@6.2.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-cas@6.2.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T12:22:29.685630+00:00",
      "status_notes": "Vulnerability CVE-2019-11272 does not affect version 6.2.7-tuxcare.3 of org.springframework.security:spring-security-cas. CVE-2019-11272 affects PlaintextPasswordEncoder in Spring Security 4.2.x up to 4.2.12 and older versions. This class was removed from Spring Security in October 2017 (commit 12dbf2e961, 5.0+) by upstream maintainer Rob Winch, well before version 6.2.7 was released. The target repository at version 6.2.7 does not contain the vulnerable PlaintextPasswordEncoder class. The modern replacement NoOpPasswordEncoder uses safe String.equals() comparison which correctly returns false when comparing any string (including \"null\") to a null stored password, preventing the vulnerability. This is an upstream architectural change that eliminated the vulnerable code entirely.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-11272"
      },
      "impact_statement": "CVE-2019-11272 affects PlaintextPasswordEncoder in Spring Security 4.2.x up to 4.2.12 and older versions. This class was removed from Spring Security in October 2017 (commit 12dbf2e961, 5.0+) by upstream maintainer Rob Winch, well before version 6.2.7 was released. The target repository at version 6.2.7 does not contain the vulnerable PlaintextPasswordEncoder class. The modern replacement NoOpPasswordEncoder uses safe String.equals() comparison which correctly returns false when comparing any string (including \"null\") to a null stored password, preventing the vulnerability. This is an upstream architectural change that eliminated the vulnerable code entirely.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE)."
    }
  ]
}