{
  "@id": "urn:uuid:25c9eb5e-d80f-4591-9a2a-a9b9e78b123b",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 28,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:12:34.459172+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.8-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.8-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2021-22119 does not affect version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-client. The target Spring Security 6.0.8 repository is NOT AFFECTED by CVE-2021-22119. The vulnerability (DoS via unbounded accumulation of OAuth2 authorization requests in session storage) was fixed in upstream Spring Security commit 35f5ebdbcf (April 2021) and further improved in commit cae22867b2 (July 2022). Both fixes were already present in the upstream Spring Security 6.0.8 release when TuxCare onboarded it. The current implementation stores only one authorization request per session in both servlet (HttpSessionOAuth2AuthorizationRequestRepository) and WebFlux (WebSessionOAuth2ServerAuthorizationRequestRepository) implementations, preventing the resource exhaustion attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22119"
      },
      "impact_statement": "The target Spring Security 6.0.8 repository is NOT AFFECTED by CVE-2021-22119. The vulnerability (DoS via unbounded accumulation of OAuth2 authorization requests in session storage) was fixed in upstream Spring Security commit 35f5ebdbcf (April 2021) and further improved in commit cae22867b2 (July 2022). Both fixes were already present in the upstream Spring Security 6.0.8 release when TuxCare onboarded it. The current implementation stores only one authorization request per session in both servlet (HttpSessionOAuth2AuthorizationRequestRepository) and WebFlux (WebSessionOAuth2ServerAuthorizationRequestRepository) implementations, preventing the resource exhaustion attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.8-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.8-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2022-31690 does not affect version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-client. CVE-2022-31690 does not affect this target. The vulnerability (privilege escalation via automatic scope defaulting when authorization server returns empty scopes) was fixed by upstream Spring Security in commits 75004587a4 and fde26e003a, both authored by sriesenberg@vmware.com. These fixes shipped in the upstream Spring Security 6.0.8 release, which TuxCare subsequently onboarded via commit 552dddffd6. The vulnerable code pattern has been removed from all affected OAuth2 token response clients.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), cve.org (>= 5.7, <= 5.7.4; >= 5.6, <= 5.6.8), Snyk (< 5.4.11; >= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-31690"
      },
      "impact_statement": "CVE-2022-31690 does not affect this target. The vulnerability (privilege escalation via automatic scope defaulting when authorization server returns empty scopes) was fixed by upstream Spring Security in commits 75004587a4 and fde26e003a, both authored by sriesenberg@vmware.com. These fixes shipped in the upstream Spring Security 6.0.8 release, which TuxCare subsequently onboarded via commit 552dddffd6. The vulnerable code pattern has been removed from all affected OAuth2 token response clients.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), cve.org (>= 5.7, <= 5.7.4; >= 5.6, <= 5.6.8), Snyk (< 5.4.11; >= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5)."
    }
  ]
}