{
  "@id": "urn:uuid:e0d7b18e-e1aa-488a-a22b-1fe07a31985c",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-05T15:03:30.965794+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-05T15:03:30.965794+00:00",
      "status_notes": "Vulnerability CVE-2019-11272 does not affect version 6.2.8-tuxcare.7 of org.springframework.security:spring-security-cas. Spring Security 6.2.8 does not contain the vulnerable PlaintextPasswordEncoder class. The class was removed from the upstream codebase in commit 12dbf2e961 (October 2017) by upstream maintainer Rob Winch, years before TuxCare onboarded the project (March 2025). CVE-2019-11272 describes a vulnerability where PlaintextPasswordEncoder.isPasswordValid() would convert a null stored password to the string \"null\" via concatenation (encPass + \"\"), allowing authentication with password \"null\". This code path does not exist in version 6.2.8. The vulnerability was fixed in older maintenance branches (4.2.x, 3.2.x, 1.0.x) that still had the class, but the main development line removed it entirely before Spring Security 5.0. The replacement NoOpPasswordEncoder uses a different API signature (matches() instead of isPasswordValid()) and does not perform string concatenation that would convert null to \"null\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-11272"
      },
      "impact_statement": "Spring Security 6.2.8 does not contain the vulnerable PlaintextPasswordEncoder class. The class was removed from the upstream codebase in commit 12dbf2e961 (October 2017) by upstream maintainer Rob Winch, years before TuxCare onboarded the project (March 2025). CVE-2019-11272 describes a vulnerability where PlaintextPasswordEncoder.isPasswordValid() would convert a null stored password to the string \"null\" via concatenation (encPass + \"\"), allowing authentication with password \"null\". This code path does not exist in version 6.2.8. The vulnerability was fixed in older maintenance branches (4.2.x, 3.2.x, 1.0.x) that still had the class, but the main development line removed it entirely before Spring Security 5.0. The replacement NoOpPasswordEncoder uses a different API signature (matches() instead of isPasswordValid()) and does not perform string concatenation that would convert null to \"null\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE)."
    }
  ]
}