{
  "@id": "urn:uuid:eaf7d870-3bd6-4458-8408-3190e8b2c44d",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 33,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:12:34.459172+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.7.11-tuxcare.10",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.7.11-tuxcare.10"
          }
        }
      ],
      "timestamp": "2026-10-20T10:05:00.136501+00:00",
      "status_notes": "Vulnerability CVE-2007-1651 is a false positive for org.springframework.security:spring-security-oauth2-client 5.7.11-tuxcare.10. direct vulnerability is in OpenID project",
      "vulnerability": {
        "name": "CVE-2007-1651"
      },
      "impact_statement": "direct vulnerability is in OpenID project"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.7.11-tuxcare.10",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.7.11-tuxcare.10"
          }
        }
      ],
      "timestamp": "2026-10-20T10:05:00.136501+00:00",
      "status_notes": "Vulnerability CVE-2007-1652 is a false positive for org.springframework.security:spring-security-oauth2-client 5.7.11-tuxcare.10. direct vulnerability is in OpenID project",
      "vulnerability": {
        "name": "CVE-2007-1652"
      },
      "impact_statement": "direct vulnerability is in OpenID project"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.7.11-tuxcare.10",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.7.11-tuxcare.10"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2021-22119 does not affect version 5.7.11-tuxcare.10 of org.springframework.security:spring-security-oauth2-client. Spring Security 5.7.11-tuxcare.11 is NOT affected by CVE-2021-22119. The vulnerability (DoS via unbounded OAuth2 authorization request storage) was fixed in upstream Spring Security 5.5.1 (April 2021). Version 5.7.11 is significantly newer and contains the upstream fix, which limits storage to ONE authorization request per session by default through the allowMultipleAuthorizationRequests flag (defaults to false). The fix commit 35f5ebdbcf93aa380cd57ca5ef7d579ed53f2a71 by Craig Andrews was already present in the upstream 5.7.11 release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22119"
      },
      "impact_statement": "Spring Security 5.7.11-tuxcare.11 is NOT affected by CVE-2021-22119. The vulnerability (DoS via unbounded OAuth2 authorization request storage) was fixed in upstream Spring Security 5.5.1 (April 2021). Version 5.7.11 is significantly newer and contains the upstream fix, which limits storage to ONE authorization request per session by default through the allowMultipleAuthorizationRequests flag (defaults to false). The fix commit 35f5ebdbcf93aa380cd57ca5ef7d579ed53f2a71 by Craig Andrews was already present in the upstream 5.7.11 release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.7.11-tuxcare.10",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.7.11-tuxcare.10"
          }
        }
      ],
      "timestamp": "2026-11-04T09:04:11.456857+00:00",
      "status_notes": "Vulnerability CVE-2022-31690 does not affect version 5.7.11-tuxcare.10 of org.springframework.security:spring-security-oauth2-client. CVE-2022-31690 (OAuth2 scope privilege escalation) is NOT PRESENT in Spring Security 5.7.11-tuxcare.11. The vulnerability involved automatic defaulting of empty OAuth2 scope responses to originally requested scopes, enabling privilege escalation. Upstream Spring Security fixed this in commits 75004587a4 (removes scope defaulting logic) and fde26e003a (ensures user info retrieval with empty scopes), both authored by sriesenberg@vmware.com. These fixes were already included in the upstream 5.7.11 release before TuxCare's initial onboarding commit (a57e508bfb). The vulnerable pattern `.scopes(clientRegistration.getScopes())` is completely absent from all six token response client classes. Target version 5.7.11 is after the fixed version 5.7.5 mentioned in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), cve.org (>= 5.7, <= 5.7.4; >= 5.6, <= 5.6.8), Snyk (< 5.4.11; >= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-31690"
      },
      "impact_statement": "CVE-2022-31690 (OAuth2 scope privilege escalation) is NOT PRESENT in Spring Security 5.7.11-tuxcare.11. The vulnerability involved automatic defaulting of empty OAuth2 scope responses to originally requested scopes, enabling privilege escalation. Upstream Spring Security fixed this in commits 75004587a4 (removes scope defaulting logic) and fde26e003a (ensures user info retrieval with empty scopes), both authored by sriesenberg@vmware.com. These fixes were already included in the upstream 5.7.11 release before TuxCare's initial onboarding commit (a57e508bfb). The vulnerable pattern `.scopes(clientRegistration.getScopes())` is completely absent from all six token response client classes. Target version 5.7.11 is after the fixed version 5.7.5 mentioned in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), cve.org (>= 5.7, <= 5.7.4; >= 5.6, <= 5.6.8), Snyk (< 5.4.11; >= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5)."
    }
  ]
}