{
  "@id": "urn:uuid:1f749a0c-3840-4c21-9f58-67e4345f818b",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 27,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:12:34.459172+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.4.3-tuxcare.10",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.4.3-tuxcare.10"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2021-22119 does not affect version 6.4.3-tuxcare.10 of org.springframework.security:spring-security-oauth2-client. CVE-2021-22119 is NOT present in Spring Security 6.4.3. The vulnerability (DoS via unlimited OAuth2 authorization request accumulation) was fixed in upstream commit 35f5ebdbcf, which shipped in Spring Security 5.5.1 (May 2021). Version 6.4.3 contains an evolved version of the fix that completely removes the vulnerable Map-based storage mechanism. The fix was authored by Craig Andrews (candrews@integralblue.com) and was already present in the upstream release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22119"
      },
      "impact_statement": "CVE-2021-22119 is NOT present in Spring Security 6.4.3. The vulnerability (DoS via unlimited OAuth2 authorization request accumulation) was fixed in upstream commit 35f5ebdbcf, which shipped in Spring Security 5.5.1 (May 2021). Version 6.4.3 contains an evolved version of the fix that completely removes the vulnerable Map-based storage mechanism. The fix was authored by Craig Andrews (candrews@integralblue.com) and was already present in the upstream release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.4.3-tuxcare.10",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.4.3-tuxcare.10"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2022-31690 does not affect version 6.4.3-tuxcare.10 of org.springframework.security:spring-security-oauth2-client. CVE-2022-31690 is NOT present in Spring Security 6.4.3. The vulnerability involved automatic scope mapping where empty OAuth2 token response scopes would be incorrectly filled with requested scopes from the client registration, leading to privilege escalation. Both upstream fix commits (75004587a4 \"Fix scope mapping\" and fde26e003a \"Request user info when AS returns no scopes\") are present in HEAD and were included in the upstream Spring Security 6.4.3 release before TuxCare onboarded it. The vulnerable code pattern has been removed from all authorization code, client credentials, and password grant flows. Refresh token flows intentionally retain scope mapping per RFC 6749 Section 6.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), cve.org (>= 5.7, <= 5.7.4; >= 5.6, <= 5.6.8), Snyk (< 5.4.11; >= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-31690"
      },
      "impact_statement": "CVE-2022-31690 is NOT present in Spring Security 6.4.3. The vulnerability involved automatic scope mapping where empty OAuth2 token response scopes would be incorrectly filled with requested scopes from the client registration, leading to privilege escalation. Both upstream fix commits (75004587a4 \"Fix scope mapping\" and fde26e003a \"Request user info when AS returns no scopes\") are present in HEAD and were included in the upstream Spring Security 6.4.3 release before TuxCare onboarded it. The vulnerable code pattern has been removed from all authorization code, client credentials, and password grant flows. Refresh token flows intentionally retain scope mapping per RFC 6749 Section 6.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), cve.org (>= 5.7, <= 5.7.4; >= 5.6, <= 5.6.8), Snyk (< 5.4.11; >= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5)."
    }
  ]
}