{
  "@id": "urn:uuid:43757bed-1e51-4a76-99d8-36cda989f86d",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:03:00.104314+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.dataformat/jackson-dataformat-xml@2.16.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.dataformat/jackson-dataformat-xml@2.16.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:02:00.202619+00:00",
      "status_notes": "Vulnerability CVE-2016-3720 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.dataformat:jackson-dataformat-xml. The target repository jackson-dataformat-xml version 2.16.2-tuxcare.2 is NOT AFFECTED by CVE-2016-3720. The XXE vulnerability fix (disabling external entity expansion by default) was already present in the upstream release 2.7.4 (April 2016) and is included in all subsequent versions. The target version 2.16.2 contains the fix at XmlFactory.java lines 124-127, where IS_SUPPORTING_EXTERNAL_ENTITIES is set to Boolean.FALSE. This fix was authored by the upstream maintainer Tatu Saloranta, not backported by TuxCare, as it predates all TuxCare commits in the repository.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.4), NVD (<= 2.7.3), Snyk (>= 2.0.0, < 2.7.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-3720"
      },
      "impact_statement": "The target repository jackson-dataformat-xml version 2.16.2-tuxcare.2 is NOT AFFECTED by CVE-2016-3720. The XXE vulnerability fix (disabling external entity expansion by default) was already present in the upstream release 2.7.4 (April 2016) and is included in all subsequent versions. The target version 2.16.2 contains the fix at XmlFactory.java lines 124-127, where IS_SUPPORTING_EXTERNAL_ENTITIES is set to Boolean.FALSE. This fix was authored by the upstream maintainer Tatu Saloranta, not backported by TuxCare, as it predates all TuxCare commits in the repository.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.4), NVD (<= 2.7.3), Snyk (>= 2.0.0, < 2.7.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.dataformat/jackson-dataformat-xml@2.16.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.dataformat/jackson-dataformat-xml@2.16.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:03:00.104314+00:00",
      "status_notes": "Vulnerability CVE-2016-7051 does not affect version 2.16.2-tuxcare.2 of com.fasterxml.jackson.dataformat:jackson-dataformat-xml. CVE-2016-7051 SSRF vulnerability via DTD processing is NOT present in jackson-dataformat-xml 2.16.2-tuxcare.2. The fix (disabling DTD support via XMLInputFactory.SUPPORT_DTD = Boolean.FALSE) was already present in the upstream release that TuxCare onboarded. The vulnerability pattern does not exist in the target because DTD processing is disabled by default in all XmlFactory constructors.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.8; >= 2.8.0, < 2.8.4), NVD (< 2.7.8; = 2.8.0; = 2.8.0-rc1; = 2.8.0-rc2; = 2.8.1; = 2.8.2; = 2.8.3), Snyk (>= 2.7.4, < 2.7.8; >= 2.8.0, <= 2.8.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-7051"
      },
      "impact_statement": "CVE-2016-7051 SSRF vulnerability via DTD processing is NOT present in jackson-dataformat-xml 2.16.2-tuxcare.2. The fix (disabling DTD support via XMLInputFactory.SUPPORT_DTD = Boolean.FALSE) was already present in the upstream release that TuxCare onboarded. The vulnerability pattern does not exist in the target because DTD processing is disabled by default in all XmlFactory constructors.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.8; >= 2.8.0, < 2.8.4), NVD (< 2.7.8; = 2.8.0; = 2.8.0-rc1; = 2.8.0-rc2; = 2.8.1; = 2.8.2; = 2.8.3), Snyk (>= 2.7.4, < 2.7.8; >= 2.8.0, <= 2.8.4)."
    }
  ]
}