{
  "@id": "urn:uuid:be8ac967-a9bb-40d1-9675-8c7b32b1e2f0",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 29,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:12:34.459172+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.4.13-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.4.13-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2021-22119 does not affect version 6.4.13-tuxcare.7 of org.springframework.security:spring-security-oauth2-client. CVE-2021-22119 is NOT present in Spring Security 6.4.13-tuxcare.7. The vulnerability allowed DoS via unbounded accumulation of OAuth2 authorization requests in session memory. The vulnerable pattern (Map-based storage allowing multiple requests per session) is absent from the target. The fix was applied by upstream Spring Security in commit 35f5ebdbcf (April 2021) and shipped in the upstream 6.4.13 release that TuxCare onboarded in July 2026. Both HttpSessionOAuth2AuthorizationRequestRepository (Web) and WebSessionOAuth2ServerAuthorizationRequestRepository (WebFlux) store only ONE authorization request per session, preventing accumulation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22119"
      },
      "impact_statement": "CVE-2021-22119 is NOT present in Spring Security 6.4.13-tuxcare.7. The vulnerability allowed DoS via unbounded accumulation of OAuth2 authorization requests in session memory. The vulnerable pattern (Map-based storage allowing multiple requests per session) is absent from the target. The fix was applied by upstream Spring Security in commit 35f5ebdbcf (April 2021) and shipped in the upstream 6.4.13 release that TuxCare onboarded in July 2026. Both HttpSessionOAuth2AuthorizationRequestRepository (Web) and WebSessionOAuth2ServerAuthorizationRequestRepository (WebFlux) store only ONE authorization request per session, preventing accumulation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.4.13-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.4.13-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2022-31690 does not affect version 6.4.13-tuxcare.7 of org.springframework.security:spring-security-oauth2-client. The target repository (Spring Security 6.4.13) is NOT affected by CVE-2022-31690. The vulnerability involved automatic scope defaulting when the Authorization Server returned an empty scope list, which could lead to privilege escalation. The fix was introduced by upstream Spring Security in commits 75004587a4 (Fix scope mapping) and fde26e003a (Request user info when AS returns no scopes), first released in versions 5.6.9 and 5.7.5. Since the target is version 6.4.13 (much newer than the first fixed versions), the upstream fix was already present when TuxCare onboarded this release. All token response client classes and OidcUserService contain the fixed code that preserves empty scopes instead of defaulting to requested scopes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), cve.org (>= 5.7, <= 5.7.4; >= 5.6, <= 5.6.8), Snyk (< 5.4.11; >= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-31690"
      },
      "impact_statement": "The target repository (Spring Security 6.4.13) is NOT affected by CVE-2022-31690. The vulnerability involved automatic scope defaulting when the Authorization Server returned an empty scope list, which could lead to privilege escalation. The fix was introduced by upstream Spring Security in commits 75004587a4 (Fix scope mapping) and fde26e003a (Request user info when AS returns no scopes), first released in versions 5.6.9 and 5.7.5. Since the target is version 6.4.13 (much newer than the first fixed versions), the upstream fix was already present when TuxCare onboarded this release. All token response client classes and OidcUserService contain the fixed code that preserves empty scopes instead of defaulting to requested scopes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), cve.org (>= 5.7, <= 5.7.4; >= 5.6, <= 5.6.8), Snyk (< 5.4.11; >= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5)."
    }
  ]
}