{
  "@id": "urn:uuid:d0ada816-a3d7-438c-af43-811c16391362",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 34,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T20:44:34.809299+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring@5.2.7.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring@5.2.7.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T20:44:34.809299+00:00",
      "status_notes": "Vulnerability CVE-2010-1622 does not affect version 5.2.7.RELEASE-tuxcare.2 of org.springframework:spring. not_affected \u2014 CVE-2010-1622 is NOT present in Spring Framework 5.2.7.RELEASE. The vulnerability, which allowed remote attackers to execute arbitrary code via HTTP requests binding to the Class.classLoader property, was fixed in the upstream Spring Framework release. The fix commit (3a5af35d37) is present in the target and was already part of the upstream 5.2.7.RELEASE that TuxCare onboarded. The target code ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2010-1622"
      },
      "impact_statement": "not_affected \u2014 CVE-2010-1622 is NOT present in Spring Framework 5.2.7.RELEASE. The vulnerability, which allowed remote attackers to execute arbitrary code via HTTP requests binding to the Class.classLoader property, was fixed in the upstream Spring Framework release. The fix commit (3a5af35d37) is present in the target and was already part of the upstream 5.2.7.RELEASE that TuxCare onboarded. The target code ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring@5.2.7.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring@5.2.7.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 affects version 5.2.7.RELEASE-tuxcare.2 of org.springframework:spring.",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "action_statement": "Vulnerability CVE-2021-22096 affects version 5.2.7.RELEASE-tuxcare.2 of org.springframework:spring."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring@5.2.7.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring@5.2.7.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T00:40:33.053070+00:00",
      "status_notes": "Vulnerability CVE-2023-20860 affects version 5.2.7.RELEASE-tuxcare.2 of org.springframework:spring.",
      "vulnerability": {
        "name": "CVE-2023-20860"
      },
      "action_statement": "Vulnerability CVE-2023-20860 affects version 5.2.7.RELEASE-tuxcare.2 of org.springframework:spring."
    }
  ]
}