{
  "@id": "urn:uuid:99bbcbb2-8d9d-4d43-a462-f1f037128f06",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 14,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-29T15:30:49.741847+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-starter-data-jdbc@3.5.16-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-data-jdbc@3.5.16-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2022-22965 affects version 3.5.16-tuxcare.5 of org.springframework.boot:spring-boot-starter-data-jdbc.",
      "vulnerability": {
        "name": "CVE-2022-22965"
      },
      "action_statement": "Vulnerability CVE-2022-22965 affects version 3.5.16-tuxcare.5 of org.springframework.boot:spring-boot-starter-data-jdbc."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-starter-data-jdbc@3.5.16-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-data-jdbc@3.5.16-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-28T23:37:14.382670+00:00",
      "status_notes": "Vulnerability CVE-2022-27772 affects version 3.5.16-tuxcare.5 of org.springframework.boot:spring-boot-starter-data-jdbc.",
      "vulnerability": {
        "name": "CVE-2022-27772"
      },
      "action_statement": "Vulnerability CVE-2022-27772 affects version 3.5.16-tuxcare.5 of org.springframework.boot:spring-boot-starter-data-jdbc."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-starter-data-jdbc@3.5.16-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-data-jdbc@3.5.16-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-28T22:21:49.480044+00:00",
      "status_notes": "Vulnerability CVE-2023-20883 affects version 3.5.16-tuxcare.5 of org.springframework.boot:spring-boot-starter-data-jdbc.",
      "vulnerability": {
        "name": "CVE-2023-20883"
      },
      "action_statement": "Vulnerability CVE-2023-20883 affects version 3.5.16-tuxcare.5 of org.springframework.boot:spring-boot-starter-data-jdbc."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-starter-data-jdbc@3.5.16-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-data-jdbc@3.5.16-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-28T18:32:37.090382+00:00",
      "status_notes": "Vulnerability CVE-2025-22235 affects version 3.5.16-tuxcare.5 of org.springframework.boot:spring-boot-starter-data-jdbc.",
      "vulnerability": {
        "name": "CVE-2025-22235"
      },
      "action_statement": "Vulnerability CVE-2025-22235 affects version 3.5.16-tuxcare.5 of org.springframework.boot:spring-boot-starter-data-jdbc."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-starter-data-jdbc@3.5.16-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-data-jdbc@3.5.16-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-29T06:46:50.295018+00:00",
      "status_notes": "Vulnerability CVE-2026-40971 does not affect version 3.5.16-tuxcare.5 of org.springframework.boot:spring-boot-starter-data-jdbc. not_affected \u2014 The target Spring Boot 3.5.16-tuxcare.8 is NOT AFFECTED by CVE-2026-40971. The upstream fix commit e4febe2015 (\"Apply verify-hostname consistently\") by Andy Wilkinson was already included in Spring Boot 3.5.16 when TuxCare onboarded the release. Both required code changes are present: (1) RabbitConnectionFactoryBeanConfigurer.java now applies the hostname verification setting for both SSL bundl...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-40971"
      },
      "impact_statement": "not_affected \u2014 The target Spring Boot 3.5.16-tuxcare.8 is NOT AFFECTED by CVE-2026-40971. The upstream fix commit e4febe2015 (\"Apply verify-hostname consistently\") by Andy Wilkinson was already included in Spring Boot 3.5.16 when TuxCare onboarded the release. Both required code changes are present: (1) RabbitConnectionFactoryBeanConfigurer.java now applies the hostname verification setting for both SSL bundl..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-starter-data-jdbc@3.5.16-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-data-jdbc@3.5.16-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-28T18:36:42.887038+00:00",
      "status_notes": "Vulnerability CVE-2026-40973 affects version 3.5.16-tuxcare.5 of org.springframework.boot:spring-boot-starter-data-jdbc.",
      "vulnerability": {
        "name": "CVE-2026-40973"
      },
      "action_statement": "Vulnerability CVE-2026-40973 affects version 3.5.16-tuxcare.5 of org.springframework.boot:spring-boot-starter-data-jdbc."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-starter-data-jdbc@3.5.16-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-data-jdbc@3.5.16-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-29T06:36:33.357741+00:00",
      "status_notes": "Vulnerability CVE-2026-40974 does not affect version 3.5.16-tuxcare.5 of org.springframework.boot:spring-boot-starter-data-jdbc. not_affected \u2014 The target Spring Boot 3.5.16-tuxcare.8 is not affected by CVE-2026-40974. The vulnerability concerns missing hostname verification when establishing SSL connections to Cassandra. The fix, which adds a `verifyHostname` property (defaulting to `true`) and passes it to `ProgrammaticSslEngineFactory`, was already present in the upstream Spring Boot 3.5.16 release that TuxCare onboarded. The fix wa...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-40974"
      },
      "impact_statement": "not_affected \u2014 The target Spring Boot 3.5.16-tuxcare.8 is not affected by CVE-2026-40974. The vulnerability concerns missing hostname verification when establishing SSL connections to Cassandra. The fix, which adds a `verifyHostname` property (defaulting to `true`) and passes it to `ProgrammaticSslEngineFactory`, was already present in the upstream Spring Boot 3.5.16 release that TuxCare onboarded. The fix wa..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-starter-data-jdbc@3.5.16-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-data-jdbc@3.5.16-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-29T06:32:14.253219+00:00",
      "status_notes": "Vulnerability CVE-2026-40975 does not affect version 3.5.16-tuxcare.5 of org.springframework.boot:spring-boot-starter-data-jdbc. not_affected \u2014 The target repository version 3.5.16-tuxcare.8 is NOT affected by CVE-2026-40975. The vulnerability concerns weak random number generation in Spring Boot's RandomValuePropertySource class, which historically used java.util.Random instead of java.security.SecureRandom for ${random.*} configuration placeholders. The fix (replacing Random with SecureRandom) was already present in upstream Spring B...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-40975"
      },
      "impact_statement": "not_affected \u2014 The target repository version 3.5.16-tuxcare.8 is NOT affected by CVE-2026-40975. The vulnerability concerns weak random number generation in Spring Boot's RandomValuePropertySource class, which historically used java.util.Random instead of java.security.SecureRandom for ${random.*} configuration placeholders. The fix (replacing Random with SecureRandom) was already present in upstream Spring B..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-starter-data-jdbc@3.5.16-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-data-jdbc@3.5.16-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-29T06:08:36.782808+00:00",
      "status_notes": "Vulnerability CVE-2026-40977 does not affect version 3.5.16-tuxcare.5 of org.springframework.boot:spring-boot-starter-data-jdbc. not_affected \u2014 CVE-2026-40977 is not present in Spring Boot 3.5.16-tuxcare.8. The vulnerability, which allowed local attackers to corrupt arbitrary files via symlink attacks when ApplicationPidFileWriter is configured, was fixed in the upstream Spring Boot 3.5.16 release before TuxCare onboarded it. The fix (commit f533a4549c by Andy Wilkinson from Broadcom) added LinkOption.NOFOLLOW_LINKS to prevent symlink ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-40977"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-40977 is not present in Spring Boot 3.5.16-tuxcare.8. The vulnerability, which allowed local attackers to corrupt arbitrary files via symlink attacks when ApplicationPidFileWriter is configured, was fixed in the upstream Spring Boot 3.5.16 release before TuxCare onboarded it. The fix (commit f533a4549c by Andy Wilkinson from Broadcom) added LinkOption.NOFOLLOW_LINKS to prevent symlink ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-starter-data-jdbc@3.5.16-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-data-jdbc@3.5.16-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40992 does not affect version 3.5.16-tuxcare.5 of org.springframework.boot:spring-boot-starter-data-jdbc. 3.5.16 is not vulnerable, as it is outside the affected range (>= 3.5.0, <= 3.5.14; fixed in 3.5.15). The upstream fix commit 327bef3a71561a6844ede3039a4d4e7bf38016cf ('Enable hostname verification by default in Mail auto-config') is present in the history of tuxcare-current/3.5.16: MailProperties.Ssl.verifyHostname defaults to true and MailSenderPropertiesConfiguration sets mail.<protocol>.ssl.checkserveridentity=true. Nothing to backport.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-40992"
      },
      "impact_statement": "3.5.16 is not vulnerable, as it is outside the affected range (>= 3.5.0, <= 3.5.14; fixed in 3.5.15). The upstream fix commit 327bef3a71561a6844ede3039a4d4e7bf38016cf ('Enable hostname verification by default in Mail auto-config') is present in the history of tuxcare-current/3.5.16: MailProperties.Ssl.verifyHostname defaults to true and MailSenderPropertiesConfiguration sets mail.<protocol>.ssl.checkserveridentity=true. Nothing to backport."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-starter-data-jdbc@3.5.16-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-data-jdbc@3.5.16-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41001 does not affect version 3.5.16-tuxcare.5 of org.springframework.boot:spring-boot-starter-data-jdbc. 3.5.16 is not vulnerable, as it is outside the affected range (>= 3.5.0, <= 3.5.14; fixed in 3.5.15). The upstream fix commit 4218bd76e934e5cf9e3fd3997c67b8a6b0d0c111 ('Fix predictable temp directory in Artemis embedded configuration') is present in the history of tuxcare-current/3.5.16, and ArtemisEmbeddedConfigurationFactory.getDataDir() returns new ApplicationTemp().getDir('artemis-data') rather than the vulnerable java.io.tmpdir path. Nothing to backport.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-41001"
      },
      "impact_statement": "3.5.16 is not vulnerable, as it is outside the affected range (>= 3.5.0, <= 3.5.14; fixed in 3.5.15). The upstream fix commit 4218bd76e934e5cf9e3fd3997c67b8a6b0d0c111 ('Fix predictable temp directory in Artemis embedded configuration') is present in the history of tuxcare-current/3.5.16, and ArtemisEmbeddedConfigurationFactory.getDataDir() returns new ApplicationTemp().getDir('artemis-data') rather than the vulnerable java.io.tmpdir path. Nothing to backport."
    }
  ]
}