{
  "@id": "urn:uuid:09594bdb-7a00-43ea-88cd-e8b71676031c",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 33,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T20:46:35.486637+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring@5.2.25.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring@5.2.25.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T20:46:35.486637+00:00",
      "status_notes": "Vulnerability CVE-2010-1622 does not affect version 5.2.25.RELEASE-tuxcare.2 of org.springframework:spring. not_affected \u2014 CVE-2010-1622 is NOT present in Spring Framework 5.2.25.RELEASE. The vulnerability allowed remote code execution via property binding to `class.classLoader.URLs[0]`. The original 2010 security fix (commit 3a5af35d37) filtered the classLoader property from Class introspection, and this was enhanced in 2022 (commit 996f701a19) to use a whitelist approach that only permits \"name\" properties on Cla...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2010-1622"
      },
      "impact_statement": "not_affected \u2014 CVE-2010-1622 is NOT present in Spring Framework 5.2.25.RELEASE. The vulnerability allowed remote code execution via property binding to `class.classLoader.URLs[0]`. The original 2010 security fix (commit 3a5af35d37) filtered the classLoader property from Class introspection, and this was enhanced in 2022 (commit 996f701a19) to use a whitelist approach that only permits \"name\" properties on Cla..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring@5.2.25.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring@5.2.25.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-21T18:13:42.721558+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 does not affect version 5.2.25.RELEASE-tuxcare.2 of org.springframework:spring. not_affected \u2014 The target Spring Framework 5.2.25.RELEASE is NOT vulnerable to CVE-2021-22096 (log injection). The vulnerability pattern is not present because the upstream vendor fix was already included when 5.2.25.RELEASE was released. The fix sanitizes newlines and control characters in logged values through LogFormatUtils.formatValue(), preventing attackers from injecting fabricated log entries. Fix comm...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "impact_statement": "not_affected \u2014 The target Spring Framework 5.2.25.RELEASE is NOT vulnerable to CVE-2021-22096 (log injection). The vulnerability pattern is not present because the upstream vendor fix was already included when 5.2.25.RELEASE was released. The fix sanitizes newlines and control characters in logged values through LogFormatUtils.formatValue(), preventing attackers from injecting fabricated log entries. Fix comm..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring@5.2.25.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring@5.2.25.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T00:40:33.053070+00:00",
      "status_notes": "Vulnerability CVE-2023-20860 affects version 5.2.25.RELEASE-tuxcare.2 of org.springframework:spring.",
      "vulnerability": {
        "name": "CVE-2023-20860"
      },
      "action_statement": "Vulnerability CVE-2023-20860 affects version 5.2.25.RELEASE-tuxcare.2 of org.springframework:spring."
    }
  ]
}