{ "@id": "urn:uuid:4ea71d6e-b5db-4617-8213-4fb85da75f91", "role": "Document Creator", "author": "https://tuxcare.com", "version": 2, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-15T18:54:00.174826+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-cas@5.5.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-cas@5.5.8-tuxcare.2" } } ], "timestamp": "2026-10-15T18:51:00.079440+00:00", "status_notes": "Vulnerability CVE-2020-5408 does not affect version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-cas. not_affected \u2014 Target is Spring Security 5.5.8 (official upstream release), newer than every CVE-2020-5408 affected range (fix landed in 5.3.2/5.2.4/5.1.10/5.0.16/4.2.16). CVE-2020-5408: Encryptors.queryableText() uses a fixed all-zero (null) IV with AES-CBC, producing deterministic ciphertext that lets an attacker with read access to stored ciphertext derive plaintext via dictionary/frequency attacks. The vendor's fix (the exact input patch, commit db155b3094 \"Clean up Javadoc\") did NOT add a random IV \u2014 doing so would break the deterministic-query feature \u2014 it instead DEPRECATED the queryableText() method with the note \"This encryptor is not secure. Instead, look to your data store for a mechanism to query encrypted data.\" That deprecation is present in the target: Encryptors.java lines 103-107 carry @deprecated + @Deprecated on queryableText(), and commit db155b3094 is confirmed an ancestor of HEAD. Per Rule 3 (trust vendor fix intent), deprecation is the authoritative fix and must not be deemed \"insufficient.\" The fix commit is authored by Eleftheria Stein (upstream Spring, not TuxCare/CloudLinux), and HEAD (5.5.8) is an upstream release by sriesenberg@vmware.com \u2014 so this is the UPSTREAM-fix sub-case of not_affected (justification code_not_present), not already_fixed. Patch 2 (d1909ec, BCryptPasswordEncoder null-check) is unrelated to this CVE. [VC re-run with claude-opus-4-8, prod prompt pin d46bd7a, 2026-09-16; Sonnet run failed the author gate (A2 onboarding-merge overclaim); applied manually after git verification]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-5408" }, "impact_statement": "not_affected \u2014 Target is Spring Security 5.5.8 (official upstream release), newer than every CVE-2020-5408 affected range (fix landed in 5.3.2/5.2.4/5.1.10/5.0.16/4.2.16). CVE-2020-5408: Encryptors.queryableText() uses a fixed all-zero (null) IV with AES-CBC, producing deterministic ciphertext that lets an attacker with read access to stored ciphertext derive plaintext via dictionary/frequency attacks. The vendor's fix (the exact input patch, commit db155b3094 \"Clean up Javadoc\") did NOT add a random IV \u2014 doing so would break the deterministic-query feature \u2014 it instead DEPRECATED the queryableText() method with the note \"This encryptor is not secure. Instead, look to your data store for a mechanism to query encrypted data.\" That deprecation is present in the target: Encryptors.java lines 103-107 carry @deprecated + @Deprecated on queryableText(), and commit db155b3094 is confirmed an ancestor of HEAD. Per Rule 3 (trust vendor fix intent), deprecation is the authoritative fix and must not be deemed \"insufficient.\" The fix commit is authored by Eleftheria Stein (upstream Spring, not TuxCare/CloudLinux), and HEAD (5.5.8) is an upstream release by sriesenberg@vmware.com \u2014 so this is the UPSTREAM-fix sub-case of not_affected (justification code_not_present), not already_fixed. Patch 2 (d1909ec, BCryptPasswordEncoder null-check) is unrelated to this CVE. [VC re-run with claude-opus-4-8, prod prompt pin d46bd7a, 2026-09-16; Sonnet run failed the author gate (A2 onboarding-merge overclaim); applied manually after git verification]" }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-cas@5.5.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-cas@5.5.8-tuxcare.2" } } ], "timestamp": "2026-10-15T18:51:00.079440+00:00", "status_notes": "Vulnerability CVE-2022-31690 affects version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-cas.", "vulnerability": { "name": "CVE-2022-31690" }, "action_statement": "Vulnerability CVE-2022-31690 affects version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-cas." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-cas@5.5.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-cas@5.5.8-tuxcare.2" } } ], "timestamp": "2026-10-15T18:51:00.079440+00:00", "status_notes": "Vulnerability CVE-2023-34042 does not affect version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-cas. not_affected \u2014 Spring Security version 5.5.8 is NOT affected by CVE-2023-34042. The vulnerability involves a symlink file (spring-security.xsd) that creates world-writable permissions when packaged into the JAR. However, this symlink was introduced on 2023-05-19 (commit 1eefd433b6), more than a year AFTER version 5.5.8 was released (2022-05-18). Git history confirms the symlink commit is not in the ancestry o...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-34042" }, "impact_statement": "not_affected \u2014 Spring Security version 5.5.8 is NOT affected by CVE-2023-34042. The vulnerability involves a symlink file (spring-security.xsd) that creates world-writable permissions when packaged into the JAR. However, this symlink was introduced on 2023-05-19 (commit 1eefd433b6), more than a year AFTER version 5.5.8 was released (2022-05-18). Git history confirms the symlink commit is not in the ancestry o..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-cas@5.5.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-cas@5.5.8-tuxcare.2" } } ], "timestamp": "2026-10-15T18:51:00.079440+00:00", "status_notes": "Vulnerability CVE-2024-22257 is fixed in version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-cas.", "vulnerability": { "name": "CVE-2024-22257" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-cas@5.5.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-cas@5.5.8-tuxcare.2" } } ], "timestamp": "2026-10-15T18:51:00.079440+00:00", "status_notes": "Vulnerability CVE-2024-38821 is fixed in version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-cas.", "vulnerability": { "name": "CVE-2024-38821" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-cas@5.5.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-cas@5.5.8-tuxcare.2" } } ], "timestamp": "2026-10-15T18:51:00.079440+00:00", "status_notes": "Vulnerability CVE-2024-38827 is fixed in version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-cas.", "vulnerability": { "name": "CVE-2024-38827" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-cas@5.5.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-cas@5.5.8-tuxcare.2" } } ], "timestamp": "2026-10-15T18:51:00.079440+00:00", "status_notes": "Vulnerability CVE-2025-22228 is fixed in version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-cas.", "vulnerability": { "name": "CVE-2025-22228" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-cas@5.5.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-cas@5.5.8-tuxcare.2" } } ], "timestamp": "2026-10-15T18:51:00.079440+00:00", "status_notes": "Vulnerability CVE-2025-22234 does not affect version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-cas. not_affected \u2014 Spring Security 5.5.8 (released May 2022) does NOT contain CVE-2025-22234. This CVE is a regression bug introduced by patch 1 (commit c1aa99fdd2, April 2025) which added conditional 72-byte password length enforcement to BCrypt that inadvertently broke timing attack mitigation in DaoAuthenticationProvider. The target repository lacks this conditional check entirely\u2014BCrypt.java contains no passw...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-22234" }, "impact_statement": "not_affected \u2014 Spring Security 5.5.8 (released May 2022) does NOT contain CVE-2025-22234. This CVE is a regression bug introduced by patch 1 (commit c1aa99fdd2, April 2025) which added conditional 72-byte password length enforcement to BCrypt that inadvertently broke timing attack mitigation in DaoAuthenticationProvider. The target repository lacks this conditional check entirely\u2014BCrypt.java contains no passw..." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-cas@5.5.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-cas@5.5.8-tuxcare.2" } } ], "timestamp": "2026-10-15T18:51:00.079440+00:00", "status_notes": "Vulnerability CVE-2026-22732 is fixed in version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-cas.", "vulnerability": { "name": "CVE-2026-22732" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-cas@5.5.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-cas@5.5.8-tuxcare.2" } } ], "timestamp": "2026-10-15T18:51:00.079440+00:00", "status_notes": "Vulnerability CVE-2026-22746 is fixed in version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-cas.", "vulnerability": { "name": "CVE-2026-22746" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-cas@5.5.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-cas@5.5.8-tuxcare.2" } } ], "timestamp": "2026-10-15T18:51:00.079440+00:00", "status_notes": "Vulnerability CVE-2026-22747 is fixed in version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-cas.", "vulnerability": { "name": "CVE-2026-22747" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-cas@5.5.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-cas@5.5.8-tuxcare.2" } } ], "timestamp": "2026-10-15T18:51:00.079440+00:00", "status_notes": "Vulnerability CVE-2026-22748 does not affect version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-cas. not_affected \u2014 Spring Security 5.5.8 is not affected by CVE-2026-22748. The vulnerability concerns the builder methods NimbusJwtDecoder.withIssuerLocation() and NimbusReactiveJwtDecoder.withIssuerLocation(), which do not exist in version 5.5.8. These methods were introduced in Spring Security 6.1.0-RC1 (commit 76eba9bd0c, April 2023), approximately 7196 commits after version 5.5.8. Version 5.5.8 provides equi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-22748" }, "impact_statement": "not_affected \u2014 Spring Security 5.5.8 is not affected by CVE-2026-22748. The vulnerability concerns the builder methods NimbusJwtDecoder.withIssuerLocation() and NimbusReactiveJwtDecoder.withIssuerLocation(), which do not exist in version 5.5.8. These methods were introduced in Spring Security 6.1.0-RC1 (commit 76eba9bd0c, April 2023), approximately 7196 commits after version 5.5.8. Version 5.5.8 provides equi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-cas@5.5.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-cas@5.5.8-tuxcare.2" } } ], "timestamp": "2026-10-15T18:51:00.079440+00:00", "status_notes": "Vulnerability CVE-2026-22753 does not affect version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-cas. Spring Security version 5.5.8 is not affected by CVE-2026-22753. The vulnerability requires securityMatchers(String) method and PathPatternRequestMatcher.Builder bean support, neither of which exist in version 5.5.8. The securityMatchers method was first introduced in version 5.8.0-RC1 (September 2022), and PathPatternRequestMatcher infrastructure was added in versions 6.5.x+/7.0.x+ (February 2025). Version 5.5.8 (released May 2022) predates both of these features by months to years, making the vulnerable code pattern impossible to manifest.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-22753" }, "impact_statement": "Spring Security version 5.5.8 is not affected by CVE-2026-22753. The vulnerability requires securityMatchers(String) method and PathPatternRequestMatcher.Builder bean support, neither of which exist in version 5.5.8. The securityMatchers method was first introduced in version 5.8.0-RC1 (September 2022), and PathPatternRequestMatcher infrastructure was added in versions 6.5.x+/7.0.x+ (February 2025). Version 5.5.8 (released May 2022) predates both of these features by months to years, making the vulnerable code pattern impossible to manifest." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-cas@5.5.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-cas@5.5.8-tuxcare.2" } } ], "timestamp": "2026-10-15T18:51:00.079440+00:00", "status_notes": "Vulnerability CVE-2026-22754 does not affect version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-cas. Spring Security 5.5.8 is not affected by CVE-2026-22754. The vulnerability exists in PathPatternRequestMatcher.Builder (Spring Security 7.0.0-7.0.4) where a builder pattern bug prevents the basePath from being configured, causing servlet-path-aware authorization rules to be bypassed. Version 5.5.8 uses a different architecture (MvcRequestMatcher) that correctly handles servlet-path configuration through direct property assignment rather than a builder pattern, and therefore does not contain the vulnerable code path.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-22754" }, "impact_statement": "Spring Security 5.5.8 is not affected by CVE-2026-22754. The vulnerability exists in PathPatternRequestMatcher.Builder (Spring Security 7.0.0-7.0.4) where a builder pattern bug prevents the basePath from being configured, causing servlet-path-aware authorization rules to be bypassed. Version 5.5.8 uses a different architecture (MvcRequestMatcher) that correctly handles servlet-path configuration through direct property assignment rather than a builder pattern, and therefore does not contain the vulnerable code path." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-cas@5.5.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-cas@5.5.8-tuxcare.2" } } ], "timestamp": "2026-10-15T18:51:00.079440+00:00", "status_notes": "Vulnerability CVE-2026-40988 is fixed in version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-cas.", "vulnerability": { "name": "CVE-2026-40988" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-cas@5.5.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-cas@5.5.8-tuxcare.2" } } ], "timestamp": "2026-10-15T18:51:00.079440+00:00", "status_notes": "Vulnerability CVE-2026-40993 does not affect version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-cas. Spring Security 5.5.8 is not affected by CVE-2026-40993. The vulnerable class JdbcAssertingPartyMetadataRepository and the entire JDBC-backed SAML2 repository feature do not exist in this version. The SAML2 module in 5.5.8 only supports in-memory storage via InMemoryRelyingPartyRegistrationRepository, with no database persistence, no credential deserialization, and no path for the attack vector described in the CVE. The vulnerable feature was introduced in Spring Security 7.0.0.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-40993" }, "impact_statement": "Spring Security 5.5.8 is not affected by CVE-2026-40993. The vulnerable class JdbcAssertingPartyMetadataRepository and the entire JDBC-backed SAML2 repository feature do not exist in this version. The SAML2 module in 5.5.8 only supports in-memory storage via InMemoryRelyingPartyRegistrationRepository, with no database persistence, no credential deserialization, and no path for the attack vector described in the CVE. The vulnerable feature was introduced in Spring Security 7.0.0." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-cas@5.5.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-cas@5.5.8-tuxcare.2" } } ], "timestamp": "2026-10-15T18:51:00.079440+00:00", "status_notes": "Vulnerability CVE-2026-41003 is fixed in version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-cas.", "vulnerability": { "name": "CVE-2026-41003" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-cas@5.5.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-cas@5.5.8-tuxcare.2" } } ], "timestamp": "2026-10-15T18:51:00.079440+00:00", "status_notes": "Vulnerability CVE-2026-41694 is fixed in version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-cas.", "vulnerability": { "name": "CVE-2026-41694" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-cas@5.5.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-cas@5.5.8-tuxcare.2" } } ], "timestamp": "2026-10-15T18:51:00.079440+00:00", "status_notes": "Vulnerability CVE-2026-41706 is fixed in version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-cas.", "vulnerability": { "name": "CVE-2026-41706" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-cas@5.5.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-cas@5.5.8-tuxcare.2" } } ], "timestamp": "2026-10-15T18:51:00.079440+00:00", "status_notes": "Vulnerability CVE-2026-47838 affects version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-cas.", "vulnerability": { "name": "CVE-2026-47838" }, "action_statement": "Vulnerability CVE-2026-47838 affects version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-cas." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-cas@5.5.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-cas@5.5.8-tuxcare.2" } } ], "timestamp": "2026-10-15T18:54:00.174826+00:00", "status_notes": "Vulnerability CVE-2026-47842 is fixed in version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-cas.", "vulnerability": { "name": "CVE-2026-47842" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-cas@5.5.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-cas@5.5.8-tuxcare.2" } } ], "timestamp": "2026-10-15T18:54:00.174826+00:00", "status_notes": "Vulnerability CVE-2026-59270 is fixed in version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-cas.", "vulnerability": { "name": "CVE-2026-59270" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-cas@5.5.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-cas@5.5.8-tuxcare.2" } } ], "timestamp": "2026-10-15T18:54:00.174826+00:00", "status_notes": "Vulnerability CVE-2026-59276 is fixed in version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-cas.", "vulnerability": { "name": "CVE-2026-59276" } } ] }