{
  "@id": "urn:uuid:62ace67d-8579-44b1-af31-946e59dad236",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 48,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T14:58:56.128088+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T00:41:30.179479+00:00",
      "status_notes": "Vulnerability CVE-2022-22968 does not affect version 5.3.29-tuxcare.2 of org.springframework:spring-context. not_affected \u2014 CVE-2022-22968 describes a case-sensitivity bypass in Spring Framework's DataBinder disallowedFields patterns. The vulnerability allowed attackers to modify protected fields by varying the case of field names (e.g., \"id\" vs \"Id\"). Version 5.3.29 is NOT affected because the upstream vendor (VMware/Spring) already included the fix in this release before TuxCare onboarded it. The fix implements ca...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22968"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-22968 describes a case-sensitivity bypass in Spring Framework's DataBinder disallowedFields patterns. The vulnerability allowed attackers to modify protected fields by varying the case of field names (e.g., \"id\" vs \"Id\"). Version 5.3.29 is NOT affected because the upstream vendor (VMware/Spring) already included the fix in this release before TuxCare onboarded it. The fix implements ca..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-38820 is fixed in version 5.3.29-tuxcare.2 of org.springframework:spring-context.",
      "vulnerability": {
        "name": "CVE-2024-38820"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-22233 is fixed in version 5.3.29-tuxcare.2 of org.springframework:spring-context.",
      "vulnerability": {
        "name": "CVE-2025-22233"
      }
    }
  ]
}