{
  "@id": "urn:uuid:91ee87ff-2883-44e4-82c3-87acab95fe38",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 45,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-05T14:17:00.037131+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-context@6.2.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-context@6.2.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-31T01:03:06.305616+00:00",
      "status_notes": "Vulnerability CVE-2022-22968 does not affect version 6.2.19-tuxcare.3 of org.springframework:spring-context. not_affected \u2014 CVE-2022-22968 describes a case-sensitivity flaw in Spring Framework's DataBinder.setDisallowedFields() that allowed attackers to bypass field restrictions using case variations (e.g., \"Age\" vs \"age\"). The target (Spring Framework 6.2.19-tuxcare.3) is NOT AFFECTED because the vulnerable pattern is not present. The upstream Spring Framework 6.2.19 release already included a fix via commit ee6270...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22968"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-22968 describes a case-sensitivity flaw in Spring Framework's DataBinder.setDisallowedFields() that allowed attackers to bypass field restrictions using case variations (e.g., \"Age\" vs \"age\"). The target (Spring Framework 6.2.19-tuxcare.3) is NOT AFFECTED because the vulnerable pattern is not present. The upstream Spring Framework 6.2.19 release already included a fix via commit ee6270..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-context@6.2.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-context@6.2.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T14:17:00.037131+00:00",
      "status_notes": "Vulnerability CVE-2024-38820 does not affect version 6.2.19-tuxcare.3 of org.springframework:spring-context. Version 6.2.19 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-4gc7-5j7h-4qph (affected below 6.1.14), NVD (affected below 6.1.14), CVE record (affected below 6.1.14), Snyk (affected below 6.1.14).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38820"
      },
      "impact_statement": "Version 6.2.19 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-4gc7-5j7h-4qph (affected below 6.1.14), NVD (affected below 6.1.14), CVE record (affected below 6.1.14), Snyk (affected below 6.1.14)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-context@6.2.19-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-context@6.2.19-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T02:48:12.612717+00:00",
      "status_notes": "Vulnerability CVE-2025-22233 does not affect version 6.2.19-tuxcare.3 of org.springframework:spring-context. not_affected \u2014 The target Spring Framework 6.2.19-tuxcare.3 is NOT AFFECTED by CVE-2025-22233. The upstream Spring Framework 6.2.19 release already contained the fix for this disallowedFields bypass vulnerability. The vulnerable pattern (lowercasing field names and patterns using toLowerCase() before matching) has been completely replaced with algorithmic case-insensitive pattern matching via PatternMatchUtil...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22233"
      },
      "impact_statement": "not_affected \u2014 The target Spring Framework 6.2.19-tuxcare.3 is NOT AFFECTED by CVE-2025-22233. The upstream Spring Framework 6.2.19 release already contained the fix for this disallowedFields bypass vulnerability. The vulnerable pattern (lowercasing field names and patterns using toLowerCase() before matching) has been completely replaced with algorithmic case-insensitive pattern matching via PatternMatchUtil..."
    }
  ]
}