{ "@id": "urn:uuid:13b47762-1123-476c-9699-0aa8dc9923ba", "role": "Document Creator", "author": "https://tuxcare.com", "version": 1, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-11T03:40:05.021795+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3" } } ], "timestamp": "2026-11-11T03:40:05.021795+00:00", "status_notes": "Vulnerability CVE-2010-3700 does not affect version 5.5.7-tuxcare.3 of org.springframework.security:spring-security-core. Prechecker: No vulnerable code from the fix was found, and every line the fix adds is already in this version. Version 5.5.7 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-3295-h9qx-r82x (affected up to 3.0.4), Snyk (affected up to 3.0.4.RELEASE).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2010-3700" }, "impact_statement": "Prechecker: No vulnerable code from the fix was found, and every line the fix adds is already in this version. Version 5.5.7 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-3295-h9qx-r82x (affected up to 3.0.4), Snyk (affected up to 3.0.4.RELEASE)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3" } } ], "timestamp": "2026-11-11T03:40:05.021795+00:00", "status_notes": "Vulnerability CVE-2011-2731 does not affect version 5.5.7-tuxcare.3 of org.springframework.security:spring-security-core. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 5.5.7 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-4644-hg35-55m9 (affected up to 3.0.6), Snyk (affected up to 3.0.6.RELEASE).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2011-2731" }, "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 5.5.7 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-4644-hg35-55m9 (affected up to 3.0.6), Snyk (affected up to 3.0.6.RELEASE)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3" } } ], "timestamp": "2026-11-11T03:40:05.021795+00:00", "status_notes": "Vulnerability CVE-2011-2732 affects version 5.5.7-tuxcare.3 of org.springframework.security:spring-security-core.", "vulnerability": { "name": "CVE-2011-2732" }, "action_statement": "Vulnerability CVE-2011-2732 affects version 5.5.7-tuxcare.3 of org.springframework.security:spring-security-core." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3" } } ], "timestamp": "2026-11-11T03:40:05.021795+00:00", "status_notes": "Vulnerability CVE-2011-2894 does not affect version 5.5.7-tuxcare.3 of org.springframework.security:spring-security-core. Prechecker: No vulnerable code from the fix was found, and every line the fix adds is already in this version. Version 5.5.7 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-f866-m9mv-2xr3 (affected up to 3.0.6), NVD (affected up to 2.0.6), Snyk (affected up to 3.0.6.RELEASE).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2011-2894" }, "impact_statement": "Prechecker: No vulnerable code from the fix was found, and every line the fix adds is already in this version. Version 5.5.7 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-f866-m9mv-2xr3 (affected up to 3.0.6), NVD (affected up to 2.0.6), Snyk (affected up to 3.0.6.RELEASE)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3" } } ], "timestamp": "2026-11-11T03:40:05.021795+00:00", "status_notes": "Vulnerability CVE-2012-5055 does not affect version 5.5.7-tuxcare.3 of org.springframework.security:spring-security-core. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 5.5.7 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-3533-rvpc-6x56 (affected up to 3.1.3), Snyk (affected up to 3.1.3.RELEASE).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2012-5055" }, "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 5.5.7 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-3533-rvpc-6x56 (affected up to 3.1.3), Snyk (affected up to 3.1.3.RELEASE)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3" } } ], "timestamp": "2026-11-11T03:40:05.021795+00:00", "status_notes": "Vulnerability CVE-2014-0097 affects version 5.5.7-tuxcare.3 of org.springframework.security:spring-security-core.", "vulnerability": { "name": "CVE-2014-0097" }, "action_statement": "Vulnerability CVE-2014-0097 affects version 5.5.7-tuxcare.3 of org.springframework.security:spring-security-core." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3" } } ], "timestamp": "2026-11-11T03:40:05.021795+00:00", "status_notes": "Vulnerability CVE-2014-3527 does not affect version 5.5.7-tuxcare.3 of org.springframework.security:spring-security-core. Spring Security 5.5.7 is not affected by CVE-2014-3527. The fix 934937d9c1 (SEC-2688) is an ancestor of tuxcare-current/5.5.7; ServiceAuthenticationDetailsSource passes ServiceProperties.getService() and DefaultServiceAuthenticationDetails builds the CAS service URL from it, not from the request scheme/host/port, so the vulnerable code is not present.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-3527" }, "impact_statement": "Spring Security 5.5.7 is not affected by CVE-2014-3527. The fix 934937d9c1 (SEC-2688) is an ancestor of tuxcare-current/5.5.7; ServiceAuthenticationDetailsSource passes ServiceProperties.getService() and DefaultServiceAuthenticationDetails builds the CAS service URL from it, not from the request scheme/host/port, so the vulnerable code is not present." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3" } } ], "timestamp": "2026-11-11T03:40:05.021795+00:00", "status_notes": "Vulnerability CVE-2016-5007 affects version 5.5.7-tuxcare.3 of org.springframework.security:spring-security-core.", "vulnerability": { "name": "CVE-2016-5007" }, "action_statement": "Vulnerability CVE-2016-5007 affects version 5.5.7-tuxcare.3 of org.springframework.security:spring-security-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3" } } ], "timestamp": "2026-11-11T03:40:05.021795+00:00", "status_notes": "Vulnerability CVE-2016-9879 affects version 5.5.7-tuxcare.3 of org.springframework.security:spring-security-core.", "vulnerability": { "name": "CVE-2016-9879" }, "action_statement": "Vulnerability CVE-2016-9879 affects version 5.5.7-tuxcare.3 of org.springframework.security:spring-security-core." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3" } } ], "timestamp": "2026-11-11T03:40:05.021795+00:00", "status_notes": "Vulnerability CVE-2017-4995 does not affect version 5.5.7-tuxcare.3 of org.springframework.security:spring-security-core. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 5.5.7 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-vhrg-v3cv-p247 (affected up to 5.0.0.M2), NVD (affected up to 5.0.0-m1), Snyk (affected up to 4.2.3.RELEASE).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2017-4995" }, "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 5.5.7 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-vhrg-v3cv-p247 (affected up to 5.0.0.M2), NVD (affected up to 5.0.0-m1), Snyk (affected up to 4.2.3.RELEASE)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3" } } ], "timestamp": "2026-11-11T03:40:05.021795+00:00", "status_notes": "Vulnerability CVE-2018-1199 does not affect version 5.5.7-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 Target (spring-security 5.5.7) already contains the upstream fix for CVE-2018-1199. Commit 0eef5b4b (\"Add StrictHttpFirewall\", author Rob Winch, upstream) is an ancestor of HEAD and of the first TuxCare onboarding commit. StrictHttpFirewall is the default firewall in FilterChainProxy and rejects URLs containing ';' or '%3b', so path-parameter bypasses of security matching never reach the filter...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1199" }, "impact_statement": "not_affected \u2014 Target (spring-security 5.5.7) already contains the upstream fix for CVE-2018-1199. Commit 0eef5b4b (\"Add StrictHttpFirewall\", author Rob Winch, upstream) is an ancestor of HEAD and of the first TuxCare onboarding commit. StrictHttpFirewall is the default firewall in FilterChainProxy and rejects URLs containing ';' or '%3b', so path-parameter bypasses of security matching never reach the filter..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3" } } ], "timestamp": "2026-11-11T03:40:05.021795+00:00", "status_notes": "Vulnerability CVE-2018-15801 does not affect version 5.5.7-tuxcare.3 of org.springframework.security:spring-security-core. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 5.5.7 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-27xw-p8v6-9jjr (affected up to 5.1.2), CVE record (affected up to 5.1.2), Snyk (affected up to 5.1.2.RELEASE).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-15801" }, "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 5.5.7 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-27xw-p8v6-9jjr (affected up to 5.1.2), CVE record (affected up to 5.1.2), Snyk (affected up to 5.1.2.RELEASE)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3" } } ], "timestamp": "2026-11-11T03:40:05.021795+00:00", "status_notes": "Vulnerability CVE-2019-11272 does not affect version 5.5.7-tuxcare.3 of org.springframework.security:spring-security-core. Prechecker: No vulnerable code from the fix was found; the fixed code and the component it belongs to are absent from this version. Version 5.5.7 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-v33x-prhc-gph5 (affected up to 4.2.13), NVD (affected up to 4.2.13), CVE record (affected up to 4.2.13.RELEASE), Snyk (affected up to 4.2.13.RELEASE).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-11272" }, "impact_statement": "Prechecker: No vulnerable code from the fix was found; the fixed code and the component it belongs to are absent from this version. Version 5.5.7 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-v33x-prhc-gph5 (affected up to 4.2.13), NVD (affected up to 4.2.13), CVE record (affected up to 4.2.13.RELEASE), Snyk (affected up to 4.2.13.RELEASE)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3" } } ], "timestamp": "2026-11-11T03:40:05.021795+00:00", "status_notes": "Vulnerability CVE-2019-3795 does not affect version 5.5.7-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 Not affected. SecureRandomFactoryBean.getObject() in this 5.5.7 target already forces default self-seeding (nextBytes) before applying the user-supplied seed, so the seed only supplements system entropy. The fix is upstream commit 9c1eac79e2ab (Josh Cummings, josh.cummings@gmail.com), which is in the upstream release TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-3795" }, "impact_statement": "not_affected \u2014 Not affected. SecureRandomFactoryBean.getObject() in this 5.5.7 target already forces default self-seeding (nextBytes) before applying the user-supplied seed, so the seed only supplements system entropy. The fix is upstream commit 9c1eac79e2ab (Josh Cummings, josh.cummings@gmail.com), which is in the upstream release TuxCare onboarded." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3" } } ], "timestamp": "2026-11-11T03:40:05.021795+00:00", "status_notes": "Vulnerability CVE-2020-5407 does not affect version 5.5.7-tuxcare.3 of org.springframework.security:spring-security-core. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 5.5.7 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-48rw-j489-928m (affected up to 5.3.2), NVD (affected up to 5.3.2), CVE record (affected up to 5.3.2).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-5407" }, "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 5.5.7 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-48rw-j489-928m (affected up to 5.3.2), NVD (affected up to 5.3.2), CVE record (affected up to 5.3.2)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3" } } ], "timestamp": "2026-11-11T03:40:05.021795+00:00", "status_notes": "Vulnerability CVE-2020-5408 does not affect version 5.5.7-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 The upstream fix for CVE-2020-5408 is already in the 5.5.7 target. Encryptors.queryableText still uses a fixed all-zero IV, but it is @Deprecated with the javadoc \"This encryptor is not secure\". That deprecation is the vendor's chosen fix. The fix commit db155b30 was authored by a non-TuxCare upstream author and shipped in the upstream release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-5408" }, "impact_statement": "not_affected \u2014 The upstream fix for CVE-2020-5408 is already in the 5.5.7 target. Encryptors.queryableText still uses a fixed all-zero IV, but it is @Deprecated with the javadoc \"This encryptor is not secure\". That deprecation is the vendor's chosen fix. The fix commit db155b30 was authored by a non-TuxCare upstream author and shipped in the upstream release that TuxCare onboarded." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3" } } ], "timestamp": "2026-11-11T03:40:05.021795+00:00", "status_notes": "Vulnerability CVE-2021-22119 affects version 5.5.7-tuxcare.3 of org.springframework.security:spring-security-core.", "vulnerability": { "name": "CVE-2021-22119" }, "action_statement": "Vulnerability CVE-2021-22119 affects version 5.5.7-tuxcare.3 of org.springframework.security:spring-security-core." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3" } } ], "timestamp": "2026-11-11T03:40:05.021795+00:00", "status_notes": "Vulnerability CVE-2022-22976 does not affect version 5.5.7-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 Target (5.5.7) already contains the upstream fix for CVE-2022-22976. BCrypt computes the iteration count as a long (1L << log_rounds) and rejects any count above Integer.MAX_VALUE, so log_rounds=31 now throws instead of silently running zero rounds. The fix was in the upstream 5.5.7 release before the first TuxCare commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22976" }, "impact_statement": "not_affected \u2014 Target (5.5.7) already contains the upstream fix for CVE-2022-22976. BCrypt computes the iteration count as a long (1L << log_rounds) and rejects any count above Integer.MAX_VALUE, so log_rounds=31 now throws instead of silently running zero rounds. The fix was in the upstream 5.5.7 release before the first TuxCare commit." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3" } } ], "timestamp": "2026-11-11T03:40:05.021795+00:00", "status_notes": "Vulnerability CVE-2022-22978 affects version 5.5.7-tuxcare.3 of org.springframework.security:spring-security-core.", "vulnerability": { "name": "CVE-2022-22978" }, "action_statement": "Vulnerability CVE-2022-22978 affects version 5.5.7-tuxcare.3 of org.springframework.security:spring-security-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3" } } ], "timestamp": "2026-11-11T03:40:05.021795+00:00", "status_notes": "Vulnerability CVE-2022-31692 affects version 5.5.7-tuxcare.3 of org.springframework.security:spring-security-core.", "vulnerability": { "name": "CVE-2022-31692" }, "action_statement": "Vulnerability CVE-2022-31692 affects version 5.5.7-tuxcare.3 of org.springframework.security:spring-security-core." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3" } } ], "timestamp": "2026-11-11T03:40:05.021795+00:00", "status_notes": "Vulnerability CVE-2023-20862 does not affect version 5.5.7-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 Spring Security 5.5.7 predates the explicit-save architecture (SecurityContextHolderFilter / requireExplicitSave, added in 5.7) in which CVE-2023-20862 manifests. In 5.5.7, SecurityContextPersistenceFilter always saves the context after the chain. HttpSessionSecurityContextRepository then removes the session attribute whenever the pre-request context held an authentication and the post-request ...", "vulnerability": { "name": "CVE-2023-20862" }, "impact_statement": "not_affected \u2014 Spring Security 5.5.7 predates the explicit-save architecture (SecurityContextHolderFilter / requireExplicitSave, added in 5.7) in which CVE-2023-20862 manifests. In 5.5.7, SecurityContextPersistenceFilter always saves the context after the chain. HttpSessionSecurityContextRepository then removes the session attribute whenever the pre-request context held an authentication and the post-request ..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3" } } ], "timestamp": "2026-11-11T03:40:05.021795+00:00", "status_notes": "Vulnerability CVE-2024-22234 affects version 5.5.7-tuxcare.3 of org.springframework.security:spring-security-core.", "vulnerability": { "name": "CVE-2024-22234" }, "action_statement": "Vulnerability CVE-2024-22234 affects version 5.5.7-tuxcare.3 of org.springframework.security:spring-security-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3" } } ], "timestamp": "2026-11-11T03:40:05.021795+00:00", "status_notes": "Vulnerability CVE-2024-22257 is fixed in version 5.5.7-tuxcare.3 of org.springframework.security:spring-security-core.", "vulnerability": { "name": "CVE-2024-22257" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3" } } ], "timestamp": "2026-11-11T03:40:05.021795+00:00", "status_notes": "Vulnerability CVE-2024-38810 affects version 5.5.7-tuxcare.3 of org.springframework.security:spring-security-core.", "vulnerability": { "name": "CVE-2024-38810" }, "action_statement": "Vulnerability CVE-2024-38810 affects version 5.5.7-tuxcare.3 of org.springframework.security:spring-security-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3" } } ], "timestamp": "2026-11-11T03:40:05.021795+00:00", "status_notes": "Vulnerability CVE-2024-38827 is fixed in version 5.5.7-tuxcare.3 of org.springframework.security:spring-security-core.", "vulnerability": { "name": "CVE-2024-38827" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3" } } ], "timestamp": "2026-11-11T03:40:05.021795+00:00", "status_notes": "Vulnerability CVE-2025-22223 does not affect version 5.5.7-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 Not affected. CVE-2025-22223 affects the AuthorizationManager-based method security that @EnableMethodSecurity enables (Spring Security 5.7+/6.x). That code does not exist in 5.5.7. This target only has the legacy @EnableGlobalMethodSecurity and MethodSecurityMetadataSource path. That path finds annotations through Spring Framework 5.3.20's AnnotationUtils.findAnnotation, a different code path ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-22223" }, "impact_statement": "not_affected \u2014 Not affected. CVE-2025-22223 affects the AuthorizationManager-based method security that @EnableMethodSecurity enables (Spring Security 5.7+/6.x). That code does not exist in 5.5.7. This target only has the legacy @EnableGlobalMethodSecurity and MethodSecurityMetadataSource path. That path finds annotations through Spring Framework 5.3.20's AnnotationUtils.findAnnotation, a different code path ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3" } } ], "timestamp": "2026-11-11T03:40:05.021795+00:00", "status_notes": "Vulnerability CVE-2025-22234 does not affect version 5.5.7-tuxcare.3 of org.springframework.security:spring-security-core. not_affected \u2014 Not affected. CVE-2025-22234 is a regression introduced by the CVE-2025-22228 fix, which added a 72-byte password limit to BCrypt hashing. That limit made the password check fail early and broke the timing-attack mitigation in DaoAuthenticationProvider. This tree (5.5.7-tuxcare.1) has no such limit, so the regression is not present. The original timing mitigation is intact.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-22234" }, "impact_statement": "not_affected \u2014 Not affected. CVE-2025-22234 is a regression introduced by the CVE-2025-22228 fix, which added a 72-byte password limit to BCrypt hashing. That limit made the password check fail early and broke the timing-attack mitigation in DaoAuthenticationProvider. This tree (5.5.7-tuxcare.1) has no such limit, so the regression is not present. The original timing mitigation is intact." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3" } } ], "timestamp": "2026-11-11T03:40:05.021795+00:00", "status_notes": "Vulnerability CVE-2025-41232 affects version 5.5.7-tuxcare.3 of org.springframework.security:spring-security-core.", "vulnerability": { "name": "CVE-2025-41232" }, "action_statement": "Vulnerability CVE-2025-41232 affects version 5.5.7-tuxcare.3 of org.springframework.security:spring-security-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3" } } ], "timestamp": "2026-11-11T03:40:05.021795+00:00", "status_notes": "Vulnerability CVE-2025-41248 affects version 5.5.7-tuxcare.3 of org.springframework.security:spring-security-core.", "vulnerability": { "name": "CVE-2025-41248" }, "action_statement": "Vulnerability CVE-2025-41248 affects version 5.5.7-tuxcare.3 of org.springframework.security:spring-security-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3" } } ], "timestamp": "2026-11-11T03:40:05.021795+00:00", "status_notes": "Vulnerability CVE-2026-22746 is fixed in version 5.5.7-tuxcare.3 of org.springframework.security:spring-security-core.", "vulnerability": { "name": "CVE-2026-22746" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3" } } ], "timestamp": "2026-11-11T03:40:05.021795+00:00", "status_notes": "Vulnerability CVE-2026-22751 affects version 5.5.7-tuxcare.3 of org.springframework.security:spring-security-core.", "vulnerability": { "name": "CVE-2026-22751" }, "action_statement": "Vulnerability CVE-2026-22751 affects version 5.5.7-tuxcare.3 of org.springframework.security:spring-security-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3" } } ], "timestamp": "2026-11-11T03:40:05.021795+00:00", "status_notes": "Vulnerability CVE-2026-59276 is fixed in version 5.5.7-tuxcare.3 of org.springframework.security:spring-security-core.", "vulnerability": { "name": "CVE-2026-59276" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-core@5.5.7-tuxcare.3" } } ], "timestamp": "2026-11-11T03:40:05.021795+00:00", "status_notes": "Vulnerability CVE-2026-59277 does not affect version 5.5.7-tuxcare.3 of org.springframework.security:spring-security-core. Prechecker: No vulnerable code from the fix was found; the classes the fix changes and their component are absent from this version. Version 5.5.7 is on an older release line than any version the advisories list as affected. Advisories: NVD (newer lines only), CVE record (newer lines only).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-59277" }, "impact_statement": "Prechecker: No vulnerable code from the fix was found; the classes the fix changes and their component are absent from this version. Version 5.5.7 is on an older release line than any version the advisories list as affected. Advisories: NVD (newer lines only), CVE record (newer lines only)." } ] }