{
  "@id": "urn:uuid:a8b19ffd-7698-45d7-ba66-2e8383847c60",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 31,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T20:38:40.329599+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring@5.2.17.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring@5.2.17.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T20:38:40.329599+00:00",
      "status_notes": "Vulnerability CVE-2010-1622 does not affect version 5.2.17.RELEASE-tuxcare.2 of org.springframework:spring. not_affected \u2014 CVE-2010-1622 is NOT present in Spring Framework 5.2.17.RELEASE-tuxcare.3. The vulnerability allowed remote code execution via HTTP requests binding to `class.classLoader.URLs[0]`. The upstream fix (commit 3a5af35d37) was already included in Spring Framework 5.2.17.RELEASE before TuxCare onboarded it. The target contains an EVOLVED version of the fix that not only blocks the classLoader propert...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2010-1622"
      },
      "impact_statement": "not_affected \u2014 CVE-2010-1622 is NOT present in Spring Framework 5.2.17.RELEASE-tuxcare.3. The vulnerability allowed remote code execution via HTTP requests binding to `class.classLoader.URLs[0]`. The upstream fix (commit 3a5af35d37) was already included in Spring Framework 5.2.17.RELEASE before TuxCare onboarded it. The target contains an EVOLVED version of the fix that not only blocks the classLoader propert..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring@5.2.17.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring@5.2.17.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-21T17:11:15.907299+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 affects version 5.2.17.RELEASE-tuxcare.2 of org.springframework:spring.",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "action_statement": "Vulnerability CVE-2021-22096 affects version 5.2.17.RELEASE-tuxcare.2 of org.springframework:spring."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring@5.2.17.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring@5.2.17.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T00:40:33.053070+00:00",
      "status_notes": "Vulnerability CVE-2023-20860 affects version 5.2.17.RELEASE-tuxcare.2 of org.springframework:spring.",
      "vulnerability": {
        "name": "CVE-2023-20860"
      },
      "action_statement": "Vulnerability CVE-2023-20860 affects version 5.2.17.RELEASE-tuxcare.2 of org.springframework:spring."
    }
  ]
}