{
  "@id": "urn:uuid:c01465e2-33e0-4338-8e46-13d088a72efe",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 19,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-29T15:30:49.741847+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-bom@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-bom@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2007-1651 does not affect version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-bom. already_fixed \u2014 The target repository already contains the fix for CVE-2007-1651. The upstream patch commit f5468087c2 (April 15, 2010) that removes cached DiscoveryInformation from session is present in the target's git history, plus additional security enhancements from commit 89fa771093 (July 13, 2011) that add null checking and ATTRIBUTE_LIST_KEY removal.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2007-1651"
      },
      "impact_statement": "already_fixed \u2014 The target repository already contains the fix for CVE-2007-1651. The upstream patch commit f5468087c2 (April 15, 2010) that removes cached DiscoveryInformation from session is present in the target's git history, plus additional security enhancements from commit 89fa771093 (July 13, 2011) that add null checking and ATTRIBUTE_LIST_KEY removal."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-bom@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-bom@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2007-1652 does not affect version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-bom. already_fixed \u2014 The target repository (spring-security 5.7.11.tuxcare) already contains the security fixes for CVE-2007-1652. Both defensive measures from the upstream patches are present: (1) null check rejecting requests with missing DiscoveryInformation at lines 141-144, and (2) immediate session token removal at lines 149-150. These fixes were merged via upstream commits f5468087c2 (April 2010) and 89fa771...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2007-1652"
      },
      "impact_statement": "already_fixed \u2014 The target repository (spring-security 5.7.11.tuxcare) already contains the security fixes for CVE-2007-1652. Both defensive measures from the upstream patches are present: (1) null check rejecting requests with missing DiscoveryInformation at lines 141-144, and (2) immediate session token removal at lines 149-150. These fixes were merged via upstream commits f5468087c2 (April 2010) and 89fa771..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-bom@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-bom@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-22112 is fixed in version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-bom.",
      "vulnerability": {
        "name": "CVE-2021-22112"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-bom@4.2.12.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-bom@4.2.12.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41003 does not affect version 4.2.12.RELEASE-tuxcare.1 of org.springframework.security:spring-security-bom. Spring Security 4.2.12.RELEASE is outside the CVE-2026-41003 affected ranges, which begin at 5.7.0, and does not contain the vulnerable SAML2 service-provider implementation.",
      "vulnerability": {
        "name": "CVE-2026-41003"
      },
      "impact_statement": "Spring Security 4.2.12.RELEASE is outside the CVE-2026-41003 affected ranges, which begin at 5.7.0, and does not contain the vulnerable SAML2 service-provider implementation."
    }
  ]
}