{
  "@id": "urn:uuid:b6265aa0-dfbf-4fdd-90d5-d491b3087991",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T18:42:59.247053+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-config@5.1.2.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-config@5.1.2.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T18:42:59.247053+00:00",
      "status_notes": "Vulnerability CVE-2023-34034 affects version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-config.",
      "vulnerability": {
        "name": "CVE-2023-34034"
      },
      "action_statement": "Vulnerability CVE-2023-34034 affects version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-config."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-config@5.1.2.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-config@5.1.2.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T18:42:59.247053+00:00",
      "status_notes": "Vulnerability CVE-2023-34035 affects version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-config.",
      "vulnerability": {
        "name": "CVE-2023-34035"
      },
      "action_statement": "Vulnerability CVE-2023-34035 affects version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-config."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-config@5.1.2.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-config@5.1.2.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T18:42:59.247053+00:00",
      "status_notes": "Vulnerability CVE-2023-34042 does not affect version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-config. not_affected \u2014 Version 5.1.2.RELEASE is not affected by CVE-2023-34042. The vulnerability (world-writable spring-security.xsd symlink in JARs) was introduced in commit 1eefd433b6 on May 19, 2023, starting with version 5.7.9+. This is over 4.5 years AFTER version 5.1.2.RELEASE was released (November 28, 2018). The vulnerable symlink never existed in version 5.1.2.RELEASE, which predates the introduction of thi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34042"
      },
      "impact_statement": "not_affected \u2014 Version 5.1.2.RELEASE is not affected by CVE-2023-34042. The vulnerability (world-writable spring-security.xsd symlink in JARs) was introduced in commit 1eefd433b6 on May 19, 2023, starting with version 5.7.9+. This is over 4.5 years AFTER version 5.1.2.RELEASE was released (November 28, 2018). The vulnerable symlink never existed in version 5.1.2.RELEASE, which predates the introduction of thi..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-config@5.1.2.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-config@5.1.2.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T18:42:59.247053+00:00",
      "status_notes": "Vulnerability CVE-2025-22223 does not affect version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-config. Prechecker: no vulnerable code from the patch was found, and this version has none of the entry points of the fix's regression test and no class named after a file the fix changes. Advisories: GitHub, cve.org (VMware) and Snyk list only 6.4.0 to 6.4.3 as affected, so this version is older than the affected range; NVD gives no range. Confirmed not affected by the Java ELS team review on 2026-11-06.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22223"
      },
      "impact_statement": "Prechecker: no vulnerable code from the patch was found, and this version has none of the entry points of the fix's regression test and no class named after a file the fix changes. Advisories: GitHub, cve.org (VMware) and Snyk list only 6.4.0 to 6.4.3 as affected, so this version is older than the affected range; NVD gives no range. Confirmed not affected by the Java ELS team review on 2026-11-06."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-config@5.1.2.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-config@5.1.2.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T18:42:59.247053+00:00",
      "status_notes": "Vulnerability CVE-2026-22753 does not affect version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-config. Prechecker: No vulnerable code from the fix was found, and this version calls none of the distinctive methods on the lines the fix removes. Version 5.1.2.RELEASE is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-4wrg-8wpc-h923 (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22753"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and this version calls none of the distinctive methods on the lines the fix removes. Version 5.1.2.RELEASE is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-4wrg-8wpc-h923 (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-config@5.1.2.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-config@5.1.2.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T18:42:59.247053+00:00",
      "status_notes": "Vulnerability CVE-2026-22754 does not affect version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-config. Prechecker: No vulnerable code from the fix was found, and this version calls none of the distinctive methods on the lines the fix removes. Version 5.1.2.RELEASE is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-4vrc-j85c-598c (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22754"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and this version calls none of the distinctive methods on the lines the fix removes. Version 5.1.2.RELEASE is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-4vrc-j85c-598c (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only)."
    }
  ]
}