{
  "@id": "urn:uuid:fb033aa9-2675-4301-8f73-4e6bac37b213",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 6,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-29T15:30:49.741847+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-starter-jta-bitronix@2.4.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-jta-bitronix@2.4.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-22965 is a false positive for org.springframework.boot:spring-boot-starter-jta-bitronix 2.4.5-tuxcare.2. CVE-2022-22965 (Spring4Shell) vulnerable code lives in spring-framework source, not in this repo. spring-boot 2.4.5-tuxcare.4 only pins spring-framework 5.3.6 as a declared dependency in spring-boot-dependencies/build.gradle:1568. Remediation is a routine dep-version bump in the next spring-boot release (once a spring-framework -tuxcare backport of the CVE lands), not a source-level backport in this repo -- there is no MR to raise against spring-boot. Confirmed by Patch Backporter: 'no_commits_produced, source statuses: not_applicable'. Real remediation tracked under VP 86 (spring-framework x CVE-2022-22965).",
      "vulnerability": {
        "name": "CVE-2022-22965"
      },
      "impact_statement": "CVE-2022-22965 (Spring4Shell) vulnerable code lives in spring-framework source, not in this repo. spring-boot 2.4.5-tuxcare.4 only pins spring-framework 5.3.6 as a declared dependency in spring-boot-dependencies/build.gradle:1568. Remediation is a routine dep-version bump in the next spring-boot release (once a spring-framework -tuxcare backport of the CVE lands), not a source-level backport in this repo -- there is no MR to raise against spring-boot. Confirmed by Patch Backporter: 'no_commits_produced, source statuses: not_applicable'. Real remediation tracked under VP 86 (spring-framework x CVE-2022-22965)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-starter-jta-bitronix@2.4.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-jta-bitronix@2.4.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T23:37:14.382670+00:00",
      "status_notes": "Vulnerability CVE-2022-27772 affects version 2.4.5-tuxcare.2 of org.springframework.boot:spring-boot-starter-jta-bitronix.",
      "vulnerability": {
        "name": "CVE-2022-27772"
      },
      "action_statement": "Vulnerability CVE-2022-27772 affects version 2.4.5-tuxcare.2 of org.springframework.boot:spring-boot-starter-jta-bitronix."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-starter-jta-bitronix@2.4.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-jta-bitronix@2.4.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-20883 is fixed in version 2.4.5-tuxcare.2 of org.springframework.boot:spring-boot-starter-jta-bitronix.",
      "vulnerability": {
        "name": "CVE-2023-20883"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-starter-jta-bitronix@2.4.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-jta-bitronix@2.4.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-38286 affects version 2.4.5-tuxcare.2 of org.springframework.boot:spring-boot-starter-jta-bitronix.",
      "vulnerability": {
        "name": "CVE-2023-38286"
      },
      "action_statement": "Vulnerability CVE-2023-38286 affects version 2.4.5-tuxcare.2 of org.springframework.boot:spring-boot-starter-jta-bitronix."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-starter-jta-bitronix@2.4.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-jta-bitronix@2.4.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-22235 is fixed in version 2.4.5-tuxcare.2 of org.springframework.boot:spring-boot-starter-jta-bitronix.",
      "vulnerability": {
        "name": "CVE-2025-22235"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-starter-jta-bitronix@2.4.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-jta-bitronix@2.4.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T06:44:17.049175+00:00",
      "status_notes": "Vulnerability CVE-2026-40971 does not affect version 2.4.5-tuxcare.2 of org.springframework.boot:spring-boot-starter-jta-bitronix. not_affected \u2014 Spring Boot 2.4.5 does not have the SSL bundle feature that CVE-2026-40971 describes. The vulnerability is specific to SSL bundle usage in RabbitMQ auto-configuration, which was introduced in Spring Boot 3.x (commit 5556739c8c, October 2023). The target version only supports SSL via RabbitProperties.Ssl properties, where hostname verification defaults to true and is properly applied on line 148...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-40971"
      },
      "impact_statement": "not_affected \u2014 Spring Boot 2.4.5 does not have the SSL bundle feature that CVE-2026-40971 describes. The vulnerability is specific to SSL bundle usage in RabbitMQ auto-configuration, which was introduced in Spring Boot 3.x (commit 5556739c8c, October 2023). The target version only supports SSL via RabbitProperties.Ssl properties, where hostname verification defaults to true and is properly applied on line 148..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-starter-jta-bitronix@2.4.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-jta-bitronix@2.4.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40973 is fixed in version 2.4.5-tuxcare.2 of org.springframework.boot:spring-boot-starter-jta-bitronix.",
      "vulnerability": {
        "name": "CVE-2026-40973"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-starter-jta-bitronix@2.4.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-jta-bitronix@2.4.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40974 affects version 2.4.5-tuxcare.2 of org.springframework.boot:spring-boot-starter-jta-bitronix, and is fixed in 2.4.5-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-40974"
      },
      "action_statement": "Vulnerability CVE-2026-40974 affects version 2.4.5-tuxcare.2 of org.springframework.boot:spring-boot-starter-jta-bitronix, and is fixed in 2.4.5-tuxcare.4."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-starter-jta-bitronix@2.4.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-jta-bitronix@2.4.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40975 is fixed in version 2.4.5-tuxcare.2 of org.springframework.boot:spring-boot-starter-jta-bitronix.",
      "vulnerability": {
        "name": "CVE-2026-40975"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-starter-jta-bitronix@2.4.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-jta-bitronix@2.4.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40977 is fixed in version 2.4.5-tuxcare.2 of org.springframework.boot:spring-boot-starter-jta-bitronix.",
      "vulnerability": {
        "name": "CVE-2026-40977"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-starter-jta-bitronix@2.4.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-jta-bitronix@2.4.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40992 does not affect version 2.4.5-tuxcare.2 of org.springframework.boot:spring-boot-starter-jta-bitronix. not_affected \u2014 Spring Boot 2.7.18 is not affected by CVE-2026-40992. The vulnerability exists in the SSL auto-configuration feature introduced in Spring Boot 3.x/4.x (controlled via spring.mail.ssl.enabled and spring.mail.ssl.bundle properties). This SSL auto-configuration feature does not exist in version 2.7.18. In 2.7.18, users must manually configure all JavaMail properties via spring.mail.properties.*, i...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-40992"
      },
      "impact_statement": "not_affected \u2014 Spring Boot 2.7.18 is not affected by CVE-2026-40992. The vulnerability exists in the SSL auto-configuration feature introduced in Spring Boot 3.x/4.x (controlled via spring.mail.ssl.enabled and spring.mail.ssl.bundle properties). This SSL auto-configuration feature does not exist in version 2.7.18. In 2.7.18, users must manually configure all JavaMail properties via spring.mail.properties.*, i..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-starter-jta-bitronix@2.4.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-jta-bitronix@2.4.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41001 affects version 2.4.5-tuxcare.2 of org.springframework.boot:spring-boot-starter-jta-bitronix, and is fixed in 2.4.5-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-41001"
      },
      "action_statement": "Vulnerability CVE-2026-41001 affects version 2.4.5-tuxcare.2 of org.springframework.boot:spring-boot-starter-jta-bitronix, and is fixed in 2.4.5-tuxcare.4."
    }
  ]
}