{
  "@id": "urn:uuid:92170677-dafd-4539-a897-e5b7e6b0b712",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 9,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:01:00.133094+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.batch/spring-batch-core@4.3.10-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.batch/spring-batch-core@4.3.10-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-03T11:58:17.051542+00:00",
      "status_notes": "Vulnerability CVE-2019-3774 does not affect version 4.3.10-tuxcare.7 of org.springframework.batch:spring-batch-core. CVE-2019-3774 (XXE vulnerability in Spring Batch XML processing) is not present in Spring Batch 4.3.10-tuxcare.13. The fix was already included in the upstream Spring Batch 4.3.10 release that TuxCare onboarded. The target code uses secure XML parsing via StaxUtils.createDefensiveInputFactory() (Spring Framework) that disables DTD processing and external entity resolution, preventing XXE attacks. Fix commit edfbdbb82 by upstream author mbenhassine@pivotal.io is an ancestor of the first TuxCare commit, confirming it shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.10.RELEASE; >= 4.0.0.RELEASE, < 4.0.2.RELEASE; >= 4.1.0.RELEASE, < 4.1.1.RELEASE), NVD (<= 3.0.9; >= 4.0.0, <= 4.0.1; = 4.1.0), cve.org (>= 4.0, < 4.0.1.RELEASE; >= 4.1, < 4.1.0.RELEASE; >= 3.0, < 3.0.9.RELEASE), Snyk (>= 4.1.0.RELEASE, < 4.1.1.RELEASE; >= 4.0.0.RELEASE, < 4.0.2.RELEASE; >= 3.0.9.RELEASE, < 3.0.10.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3774"
      },
      "impact_statement": "CVE-2019-3774 (XXE vulnerability in Spring Batch XML processing) is not present in Spring Batch 4.3.10-tuxcare.13. The fix was already included in the upstream Spring Batch 4.3.10 release that TuxCare onboarded. The target code uses secure XML parsing via StaxUtils.createDefensiveInputFactory() (Spring Framework) that disables DTD processing and external entity resolution, preventing XXE attacks. Fix commit edfbdbb82 by upstream author mbenhassine@pivotal.io is an ancestor of the first TuxCare commit, confirming it shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.10.RELEASE; >= 4.0.0.RELEASE, < 4.0.2.RELEASE; >= 4.1.0.RELEASE, < 4.1.1.RELEASE), NVD (<= 3.0.9; >= 4.0.0, <= 4.0.1; = 4.1.0), cve.org (>= 4.0, < 4.0.1.RELEASE; >= 4.1, < 4.1.0.RELEASE; >= 3.0, < 3.0.9.RELEASE), Snyk (>= 4.1.0.RELEASE, < 4.1.1.RELEASE; >= 4.0.0.RELEASE, < 4.0.2.RELEASE; >= 3.0.9.RELEASE, < 3.0.10.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.batch/spring-batch-core@4.3.10-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.batch/spring-batch-core@4.3.10-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-04T09:01:00.133094+00:00",
      "status_notes": "Vulnerability CVE-2020-5411 does not affect version 4.3.10-tuxcare.7 of org.springframework.batch:spring-batch-core. The target Spring Batch 4.3.10-tuxcare.13 is not affected by CVE-2020-5411. The vulnerability (unrestricted Jackson default typing allowing arbitrary deserialization) was fixed in upstream Spring Batch by commit 9a79b4572d0aa4bec38fe90957c850920b7f9cea (June 2020), which replaced enableDefaultTyping() with a TrustedTypeIdResolver that whitelists safe classes. This fix was already present in the upstream 4.3.10 release (November 2023) that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.2.3), NVD (>= 4.0.0, <= 4.0.4; >= 4.1.0, <= 4.1.4; >= 4.2.0, <= 4.2.2), cve.org (>= 4, < 4.2.3), Snyk (>= 4.0.0.RELEASE, < 4.2.3.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5411"
      },
      "impact_statement": "The target Spring Batch 4.3.10-tuxcare.13 is not affected by CVE-2020-5411. The vulnerability (unrestricted Jackson default typing allowing arbitrary deserialization) was fixed in upstream Spring Batch by commit 9a79b4572d0aa4bec38fe90957c850920b7f9cea (June 2020), which replaced enableDefaultTyping() with a TrustedTypeIdResolver that whitelists safe classes. This fix was already present in the upstream 4.3.10 release (November 2023) that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.2.3), NVD (>= 4.0.0, <= 4.0.4; >= 4.1.0, <= 4.1.4; >= 4.2.0, <= 4.2.2), cve.org (>= 4, < 4.2.3), Snyk (>= 4.0.0.RELEASE, < 4.2.3.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.batch/spring-batch-core@4.3.10-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.batch/spring-batch-core@4.3.10-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-29T15:30:49.741847+00:00",
      "status_notes": "Vulnerability CVE-2026-47875 does not affect version 4.3.10-tuxcare.7 of org.springframework.batch:spring-batch-core. not_affected \u2014 Spring Batch 4.3.10 is not affected by CVE-2026-47875. The vulnerability exists only in Spring Batch 5.x, where commit 2660f2bb2 (Sept 2022) introduced arbitrary type support via Class.forName() in JobParameterDeserializer. Version 4.3.10 uses the legacy enum-based architecture with only four hardcoded parameter types (STRING, DATE, LONG, DOUBLE), and never calls Class.forName() during JobParam...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-47875"
      },
      "impact_statement": "not_affected \u2014 Spring Batch 4.3.10 is not affected by CVE-2026-47875. The vulnerability exists only in Spring Batch 5.x, where commit 2660f2bb2 (Sept 2022) introduced arbitrary type support via Class.forName() in JobParameterDeserializer. Version 4.3.10 uses the legacy enum-based architecture with only four hardcoded parameter types (STRING, DATE, LONG, DOUBLE), and never calls Class.forName() during JobParam..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.batch/spring-batch-core@4.3.10-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.batch/spring-batch-core@4.3.10-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-14T09:15:55.029942+00:00",
      "status_notes": "Vulnerability CVE-2026-47878 affects version 4.3.10-tuxcare.7 of org.springframework.batch:spring-batch-core, and is fixed in 4.3.10-tuxcare.12.",
      "vulnerability": {
        "name": "CVE-2026-47878"
      },
      "action_statement": "Vulnerability CVE-2026-47878 affects version 4.3.10-tuxcare.7 of org.springframework.batch:spring-batch-core, and is fixed in 4.3.10-tuxcare.12."
    }
  ]
}