{
  "@id": "urn:uuid:e22ce4a5-1036-4c7b-bf86-d3310f609a82",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 31,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T20:38:25.753564+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring@5.3.9-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring@5.3.9-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T20:38:25.753564+00:00",
      "status_notes": "Vulnerability CVE-2010-1622 does not affect version 5.3.9-tuxcare.2 of org.springframework:spring. not_affected \u2014 The target Spring Framework 5.3.9-tuxcare.3 is not affected by CVE-2010-1622. The fix that prevents property binding to the classLoader property was already present in the upstream Spring Framework 5.3.9 release, shipped before any TuxCare modifications. The security patch (commit 3a5af35d37) from May 2010 explicitly filters out the classLoader and protectionDomain properties during bean intros...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2010-1622"
      },
      "impact_statement": "not_affected \u2014 The target Spring Framework 5.3.9-tuxcare.3 is not affected by CVE-2010-1622. The fix that prevents property binding to the classLoader property was already present in the upstream Spring Framework 5.3.9 release, shipped before any TuxCare modifications. The security patch (commit 3a5af35d37) from May 2010 explicitly filters out the classLoader and protectionDomain properties during bean intros..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring@5.3.9-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring@5.3.9-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-21T16:44:27.378062+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 affects version 5.3.9-tuxcare.2 of org.springframework:spring.",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "action_statement": "Vulnerability CVE-2021-22096 affects version 5.3.9-tuxcare.2 of org.springframework:spring."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring@5.3.9-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring@5.3.9-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-21T16:44:27.378062+00:00",
      "status_notes": "Vulnerability CVE-2023-20860 is fixed in version 5.3.9-tuxcare.2 of org.springframework:spring.",
      "vulnerability": {
        "name": "CVE-2023-20860"
      }
    }
  ]
}