{
  "@id": "urn:uuid:856a3710-83dc-48ab-897e-5e0fa3a0f471",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 6,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:02:00.202619+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.grails/grails-core@5.3.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.grails/grails-core@5.3.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T23:28:42.058910+00:00",
      "status_notes": "Vulnerability CVE-2018-1000529 is a false positive for org.grails:grails-core 5.3.6-tuxcare.2. false_positive \u2014 CVE-2018-1000529 is a wrong-project match. The CVE concerns the Grails Fields plugin (a separate project), but the target repository is grails-core (the core Grails framework). Exhaustive searches confirmed that the Fields plugin source code is not present in this repository - neither as the project itself, nor as a vendored/bundled copy, nor as a declared dependency. The only reference found i...",
      "vulnerability": {
        "name": "CVE-2018-1000529"
      },
      "impact_statement": "false_positive \u2014 CVE-2018-1000529 is a wrong-project match. The CVE concerns the Grails Fields plugin (a separate project), but the target repository is grails-core (the core Grails framework). Exhaustive searches confirmed that the Fields plugin source code is not present in this repository - neither as the project itself, nor as a vendored/bundled copy, nor as a declared dependency. The only reference found i..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.grails/grails-core@5.3.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.grails/grails-core@5.3.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:02:00.202619+00:00",
      "status_notes": "Vulnerability CVE-2019-12728 does not affect version 5.3.6-tuxcare.2 of org.grails:grails-core. CVE-2019-12728 affects Grails before version 3.3.10, which used cleartext HTTP to resolve the SDKMan notification service plugin repository. The target repository (grails-core 5.3.6) is NOT affected because both upstream security fixes were already present in the release that TuxCare onboarded. The vulnerable HTTP repository URL (http://dl.bintray.com/vermeulen-mp/gradle-plugins) has been replaced with HTTPS, and additional validation code prevents any HTTP-based repositories from being configured. Both fixes were authored by the upstream maintainer (Graeme Rocher) in early 2019 and were included in the upstream release before TuxCare's onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.3.10), NVD (< 3.3.10), Snyk (< 3.3.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12728"
      },
      "impact_statement": "CVE-2019-12728 affects Grails before version 3.3.10, which used cleartext HTTP to resolve the SDKMan notification service plugin repository. The target repository (grails-core 5.3.6) is NOT affected because both upstream security fixes were already present in the release that TuxCare onboarded. The vulnerable HTTP repository URL (http://dl.bintray.com/vermeulen-mp/gradle-plugins) has been replaced with HTTPS, and additional validation code prevents any HTTP-based repositories from being configured. Both fixes were authored by the upstream maintainer (Graeme Rocher) in early 2019 and were included in the upstream release before TuxCare's onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.3.10), NVD (< 3.3.10), Snyk (< 3.3.10)."
    }
  ]
}