{
  "@id": "urn:uuid:3d92d7e0-36fe-464d-9576-16b1e26ae7a7",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 42,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:05:51.407283+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.1.7.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.1.7.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-30T12:09:48.333130+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 4.1.7.RELEASE-tuxcare.5 of org.springframework:spring-core. not_affected \u2014 Spring Framework 4.1.7.RELEASE is not affected by CVE-2009-1190. The vulnerability is fundamentally in JDK < 1.6's Pattern.compile method (algorithmic complexity with regex patterns containing multiple optional groups). This Spring version requires JDK 8, which is 8 years newer than JDK 1.6 where the underlying JDK issue was fixed. The target version (4.1.7.RELEASE from 2015) is also much newer...",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 4.1.7.RELEASE is not affected by CVE-2009-1190. The vulnerability is fundamentally in JDK < 1.6's Pattern.compile method (algorithmic complexity with regex patterns containing multiple optional groups). This Spring version requires JDK 8, which is 8 years newer than JDK 1.6 where the underlying JDK issue was fixed. The target version (4.1.7.RELEASE from 2015) is also much newer..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.1.7.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.1.7.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-06T17:30:50.523713+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 does not affect version 4.1.7.RELEASE-tuxcare.5 of org.springframework:spring-core. Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 4.1.7.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and the functions the fix changes were not found in this version. Version 4.1.7.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-wv88-pf73-x22p (affected up to 3.0.6), NVD (affected up to 3.0.5), Snyk (affected up to 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.1.7.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.1.7.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-03T09:37:00.071610+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 does not affect version 4.1.7.RELEASE-tuxcare.5 of org.springframework:spring-core. not_affected \u2014 Target repository Spring Framework 4.1.7.RELEASE is NOT AFFECTED by CVE-2011-2894. The vulnerability fix was already present in the upstream v4.1.7.RELEASE that TuxCare onboarded. The fix (commit 7d8aa05c4071c67d0bd8b6d2ba79f52bdbf853cb by upstream developer Juergen Hoeller on 2011-07-21) added an `acceptProxyClasses` flag to ConfigurableObjectInputStream that can be set to false to prevent des...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "impact_statement": "not_affected \u2014 Target repository Spring Framework 4.1.7.RELEASE is NOT AFFECTED by CVE-2011-2894. The vulnerability fix was already present in the upstream v4.1.7.RELEASE that TuxCare onboarded. The fix (commit 7d8aa05c4071c67d0bd8b6d2ba79f52bdbf853cb by upstream developer Juergen Hoeller on 2011-07-21) added an `acceptProxyClasses` flag to ConfigurableObjectInputStream that can be set to false to prevent des..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.1.7.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.1.7.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 does not affect version 4.1.7.RELEASE-tuxcare.5 of org.springframework:spring-core. not_affected \u2014 Target version 4.1.7.RELEASE is not affected by CVE-2014-3578. The vulnerability affects Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5. Version 4.1.7.RELEASE includes the upstream fix committed by Rossen Stoyanchev (Pivotal) in 8ee465103850a3dca018273fe5952e40d5c45a66, which validates URL prefixes to prevent directory traversal attacks via maliciously crafted colon placement. The fix w...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "impact_statement": "not_affected \u2014 Target version 4.1.7.RELEASE is not affected by CVE-2014-3578. The vulnerability affects Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5. Version 4.1.7.RELEASE includes the upstream fix committed by Rossen Stoyanchev (Pivotal) in 8ee465103850a3dca018273fe5952e40d5c45a66, which validates URL prefixes to prevent directory traversal attacks via maliciously crafted colon placement. The fix w..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.1.7.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.1.7.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-03T19:06:53.108630+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 does not affect version 4.1.7.RELEASE-tuxcare.5 of org.springframework:spring-core. not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5, where the SockJS client generated predictable session IDs using AlternativeJdkIdGenerator (which used SecureRandom only for initial seed, then non-secure Random thereafter). The vulnerability was fixed in version 4.1.5 by introducing JdkIdGenerator that calls UUID.randomUUID() for each session ID, providing cryptographically secure rand...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-0201 affects Spring Framework 4.1.x before 4.1.5, where the SockJS client generated predictable session IDs using AlternativeJdkIdGenerator (which used SecureRandom only for initial seed, then non-secure Random thereafter). The vulnerability was fixed in version 4.1.5 by introducing JdkIdGenerator that calls UUID.randomUUID() for each session ID, providing cryptographically secure rand..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.1.7.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.1.7.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 is fixed in version 4.1.7.RELEASE-tuxcare.5 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2015-5211"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.1.7.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.1.7.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 is fixed in version 4.1.7.RELEASE-tuxcare.5 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2016-5007"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.1.7.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.1.7.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 is fixed in version 4.1.7.RELEASE-tuxcare.5 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2018-11040"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.1.7.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.1.7.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-29T00:51:30.888148+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 affects version 4.1.7.RELEASE-tuxcare.5 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "action_statement": "Vulnerability CVE-2018-1199 affects version 4.1.7.RELEASE-tuxcare.5 of org.springframework:spring-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.1.7.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.1.7.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 4.1.7.RELEASE-tuxcare.5 of org.springframework:spring-core. The version is not vulnerable. [terminalized not_affected from patch_application_manual/not_vulnerable]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "The version is not vulnerable. [terminalized not_affected from patch_application_manual/not_vulnerable]"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.1.7.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.1.7.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-10T04:20:04.842645+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 does not affect version 4.1.7.RELEASE-tuxcare.5 of org.springframework:spring-core. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the code that skips method resolution for JDK proxy classes is absent. spring-aop/src/main/java/org/springframework/aop/support/AopUtils.java:177 always passes the target class to method resolution and then resolves bridge methods. spring-core/src/main/java/org/springframework/util/ClassUtils.java:762 obtains the public method from the target class, including a proxy target class.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the code that skips method resolution for JDK proxy classes is absent. spring-aop/src/main/java/org/springframework/aop/support/AopUtils.java:177 always passes the target class to method resolution and then resolves bridge methods. spring-core/src/main/java/org/springframework/util/ClassUtils.java:762 obtains the public method from the target class, including a proxy target class."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.1.7.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.1.7.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 is fixed in version 4.1.7.RELEASE-tuxcare.5 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2018-1271"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.1.7.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.1.7.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 is fixed in version 4.1.7.RELEASE-tuxcare.5 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2018-1272"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.1.7.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.1.7.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-28T22:02:19.515243+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 affects version 4.1.7.RELEASE-tuxcare.5 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "action_statement": "Vulnerability CVE-2018-15756 affects version 4.1.7.RELEASE-tuxcare.5 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.1.7.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.1.7.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-28T22:44:11.275398+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 affects version 4.1.7.RELEASE-tuxcare.5 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "action_statement": "Vulnerability CVE-2021-22060 affects version 4.1.7.RELEASE-tuxcare.5 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.1.7.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.1.7.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-08T12:58:00.834390+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 affects version 4.1.7.RELEASE-tuxcare.5 of org.springframework:spring-core, and is fixed in 4.1.7.RELEASE-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "action_statement": "Vulnerability CVE-2021-22096 affects version 4.1.7.RELEASE-tuxcare.5 of org.springframework:spring-core, and is fixed in 4.1.7.RELEASE-tuxcare.7."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.1.7.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.1.7.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-29T03:48:46.502543+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 affects version 4.1.7.RELEASE-tuxcare.5 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "action_statement": "Vulnerability CVE-2024-22233 affects version 4.1.7.RELEASE-tuxcare.5 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.1.7.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.1.7.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 affects version 4.1.7.RELEASE-tuxcare.5 of org.springframework:spring-core.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      },
      "action_statement": "Vulnerability CVE-2025-41249 affects version 4.1.7.RELEASE-tuxcare.5 of org.springframework:spring-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-core@4.1.7.RELEASE-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-core@4.1.7.RELEASE-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 affects version 4.1.7.RELEASE-tuxcare.5 of org.springframework:spring-core, and is fixed in 4.1.7.RELEASE-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      },
      "action_statement": "Vulnerability CVE-2026-41848 affects version 4.1.7.RELEASE-tuxcare.5 of org.springframework:spring-core, and is fixed in 4.1.7.RELEASE-tuxcare.6."
    }
  ]
}