{
  "@id": "urn:uuid:25acd752-e0be-4f24-9313-18ded53a4abc",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 44,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T17:58:00.190834+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-context@5.2.25.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-context@5.2.25.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T01:12:27.141825+00:00",
      "status_notes": "Vulnerability CVE-2022-22968 does not affect version 5.2.25.RELEASE-tuxcare.2 of org.springframework:spring-context. not_affected \u2014 CVE-2022-22968 is NOT present in the target. The vulnerability (case-sensitive disallowedFields pattern matching allowing bypass via case variation) was fixed in upstream Spring Framework 5.2.21. The target version 5.2.25.RELEASE already contains the complete fix from commit 833e750175 by Sam Brannen (VMware), which was included in the upstream release that TuxCare onboarded.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22968"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-22968 is NOT present in the target. The vulnerability (case-sensitive disallowedFields pattern matching allowing bypass via case variation) was fixed in upstream Spring Framework 5.2.21. The target version 5.2.25.RELEASE already contains the complete fix from commit 833e750175 by Sam Brannen (VMware), which was included in the upstream release that TuxCare onboarded."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-context@5.2.25.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-context@5.2.25.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:58:00.190834+00:00",
      "status_notes": "Vulnerability CVE-2024-38820 affects version 5.2.25.RELEASE-tuxcare.2 of org.springframework:spring-context, and is fixed in 5.2.25.RELEASE-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2024-38820"
      },
      "action_statement": "Vulnerability CVE-2024-38820 affects version 5.2.25.RELEASE-tuxcare.2 of org.springframework:spring-context, and is fixed in 5.2.25.RELEASE-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-context@5.2.25.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-context@5.2.25.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-21T18:13:42.721558+00:00",
      "status_notes": "Vulnerability CVE-2025-22233 affects version 5.2.25.RELEASE-tuxcare.2 of org.springframework:spring-context.",
      "vulnerability": {
        "name": "CVE-2025-22233"
      },
      "action_statement": "Vulnerability CVE-2025-22233 affects version 5.2.25.RELEASE-tuxcare.2 of org.springframework:spring-context."
    }
  ]
}