{
  "@id": "urn:uuid:9773a041-244d-4f2d-b7fb-4ee986653fe8",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 45,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T15:11:52.923350+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-context@6.2.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-context@6.2.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T01:17:09.380351+00:00",
      "status_notes": "Vulnerability CVE-2022-22968 does not affect version 6.2.14-tuxcare.2 of org.springframework:spring-context. not_affected \u2014 CVE-2022-22968 is NOT present in Spring Framework 6.2.14. The vulnerability concerns case-sensitive disallowedFields pattern matching in DataBinder that could allow attackers to bypass field protection using case variations. The upstream fix (commit a7cf19cec5ebd270f97a194d749e2d5701ad2ab7 by sbrannen@vmware.com, dated 2022-04-03) was already present in the upstream Spring 6.2.14 release when T...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22968"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-22968 is NOT present in Spring Framework 6.2.14. The vulnerability concerns case-sensitive disallowedFields pattern matching in DataBinder that could allow attackers to bypass field protection using case variations. The upstream fix (commit a7cf19cec5ebd270f97a194d749e2d5701ad2ab7 by sbrannen@vmware.com, dated 2022-04-03) was already present in the upstream Spring 6.2.14 release when T..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-context@6.2.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-context@6.2.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T04:12:00.223916+00:00",
      "status_notes": "Vulnerability CVE-2024-38820 does not affect version 6.2.14-tuxcare.2 of org.springframework:spring-context. not_affected \u2014 The target (Spring Framework 6.2.14 at commit 78d118e29c) is not affected by CVE-2024-38820. The vulnerable code pattern (using String.toLowerCase() without Locale specification, which causes locale-dependent case folding) is not present in the target. The upstream fix (commit 23656aebc6, October 2024) was already included in the upstream release before TuxCare onboarded version 6.2.14 in Septe...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38820"
      },
      "impact_statement": "not_affected \u2014 The target (Spring Framework 6.2.14 at commit 78d118e29c) is not affected by CVE-2024-38820. The vulnerable code pattern (using String.toLowerCase() without Locale specification, which causes locale-dependent case folding) is not present in the target. The upstream fix (commit 23656aebc6, October 2024) was already included in the upstream release before TuxCare onboarded version 6.2.14 in Septe..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-context@6.2.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-context@6.2.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T02:48:12.612717+00:00",
      "status_notes": "Vulnerability CVE-2025-22233 does not affect version 6.2.14-tuxcare.2 of org.springframework:spring-context. not_affected \u2014 Target repository spring-framework version 6.2.14 is not affected by CVE-2025-22233. The vulnerability fix was already present in the upstream Spring Framework 6.2.14 release when TuxCare onboarded it. The fix replaces the vulnerable lowercase preprocessing approach with proper case-insensitive pattern matching via PatternMatchUtils.simpleMatchIgnoreCase(). Both key components of the fix are pr...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22233"
      },
      "impact_statement": "not_affected \u2014 Target repository spring-framework version 6.2.14 is not affected by CVE-2025-22233. The vulnerability fix was already present in the upstream Spring Framework 6.2.14 release when TuxCare onboarded it. The fix replaces the vulnerable lowercase preprocessing approach with proper case-insensitive pattern matching via PatternMatchUtils.simpleMatchIgnoreCase(). Both key components of the fix are pr..."
    }
  ]
}