{
  "@id": "urn:uuid:7e46bb7a-9133-49dd-8857-098ee2d82493",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 7,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:03:00.104314+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.batch/spring-batch-core@5.0.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.batch/spring-batch-core@5.0.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:01:20.989527+00:00",
      "status_notes": "Vulnerability CVE-2019-3774 does not affect version 5.0.4-tuxcare.1 of org.springframework.batch:spring-batch-core. CVE-2019-3774 (XXE vulnerability) is not present in Spring Batch 5.0.4-tuxcare.1. The upstream vendor (Pivotal/VMware) fixed this XXE vulnerability in January 2019 (commit edfbdbb82) by disabling DTD support and external entity processing in XMLInputFactory. The fix was refined in September 2020 (commit 264243b73) when Spring Batch switched to using Spring Framework's StaxUtils.createDefensiveInputFactory(). Both commits were already present in the upstream Spring Batch 5.0.4 release when TuxCare onboarded it in July 2026. The vulnerable pattern (unprotected XML parsing allowing DTD/external entities) is not present because the defense shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.10.RELEASE; >= 4.0.0.RELEASE, < 4.0.2.RELEASE; >= 4.1.0.RELEASE, < 4.1.1.RELEASE), NVD (<= 3.0.9; >= 4.0.0, <= 4.0.1; = 4.1.0), cve.org (>= 4.0, < 4.0.1.RELEASE; >= 4.1, < 4.1.0.RELEASE; >= 3.0, < 3.0.9.RELEASE), Snyk (>= 4.1.0.RELEASE, < 4.1.1.RELEASE; >= 4.0.0.RELEASE, < 4.0.2.RELEASE; >= 3.0.9.RELEASE, < 3.0.10.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3774"
      },
      "impact_statement": "CVE-2019-3774 (XXE vulnerability) is not present in Spring Batch 5.0.4-tuxcare.1. The upstream vendor (Pivotal/VMware) fixed this XXE vulnerability in January 2019 (commit edfbdbb82) by disabling DTD support and external entity processing in XMLInputFactory. The fix was refined in September 2020 (commit 264243b73) when Spring Batch switched to using Spring Framework's StaxUtils.createDefensiveInputFactory(). Both commits were already present in the upstream Spring Batch 5.0.4 release when TuxCare onboarded it in July 2026. The vulnerable pattern (unprotected XML parsing allowing DTD/external entities) is not present because the defense shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.10.RELEASE; >= 4.0.0.RELEASE, < 4.0.2.RELEASE; >= 4.1.0.RELEASE, < 4.1.1.RELEASE), NVD (<= 3.0.9; >= 4.0.0, <= 4.0.1; = 4.1.0), cve.org (>= 4.0, < 4.0.1.RELEASE; >= 4.1, < 4.1.0.RELEASE; >= 3.0, < 3.0.9.RELEASE), Snyk (>= 4.1.0.RELEASE, < 4.1.1.RELEASE; >= 4.0.0.RELEASE, < 4.0.2.RELEASE; >= 3.0.9.RELEASE, < 3.0.10.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.batch/spring-batch-core@5.0.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.batch/spring-batch-core@5.0.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:03:00.104314+00:00",
      "status_notes": "Vulnerability CVE-2020-5411 does not affect version 5.0.4-tuxcare.1 of org.springframework.batch:spring-batch-core. The target Spring Batch 5.0.4-tuxcare.1 is NOT vulnerable to CVE-2020-5411. The vulnerable pattern (unconditional `enableDefaultTyping()` allowing arbitrary class deserialization) was removed by an upstream Spring security fix (commit 9a79b4572, June 2020) that shipped in upstream releases before TuxCare onboarded version 5.0.4. The current code implements whitelist-based type validation via TrustedTypeIdResolver, blocking deserialization of untrusted gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.2.3), NVD (>= 4.0.0, <= 4.0.4; >= 4.1.0, <= 4.1.4; >= 4.2.0, <= 4.2.2), cve.org (>= 4, < 4.2.3), Snyk (>= 4.0.0.RELEASE, < 4.2.3.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5411"
      },
      "impact_statement": "The target Spring Batch 5.0.4-tuxcare.1 is NOT vulnerable to CVE-2020-5411. The vulnerable pattern (unconditional `enableDefaultTyping()` allowing arbitrary class deserialization) was removed by an upstream Spring security fix (commit 9a79b4572, June 2020) that shipped in upstream releases before TuxCare onboarded version 5.0.4. The current code implements whitelist-based type validation via TrustedTypeIdResolver, blocking deserialization of untrusted gadget classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.2.3), NVD (>= 4.0.0, <= 4.0.4; >= 4.1.0, <= 4.1.4; >= 4.2.0, <= 4.2.2), cve.org (>= 4, < 4.2.3), Snyk (>= 4.0.0.RELEASE, < 4.2.3.RELEASE)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.batch/spring-batch-core@5.0.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.batch/spring-batch-core@5.0.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-14T08:47:07.961023+00:00",
      "status_notes": "Vulnerability CVE-2026-47875 is fixed in version 5.0.4-tuxcare.1 of org.springframework.batch:spring-batch-core.",
      "vulnerability": {
        "name": "CVE-2026-47875"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.batch/spring-batch-core@5.0.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.batch/spring-batch-core@5.0.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-14T08:47:07.961023+00:00",
      "status_notes": "Vulnerability CVE-2026-47878 is fixed in version 5.0.4-tuxcare.1 of org.springframework.batch:spring-batch-core.",
      "vulnerability": {
        "name": "CVE-2026-47878"
      }
    }
  ]
}