{
  "@id": "urn:uuid:3a9b338f-0bcb-4e4f-8f53-3cc723ce485f",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-05T14:10:16.547418+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.batch/spring-batch-core@5.1.3-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.batch/spring-batch-core@5.1.3-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-05T14:10:16.547418+00:00",
      "status_notes": "Vulnerability CVE-2019-3774 does not affect version 5.1.3-tuxcare.8 of org.springframework.batch:spring-batch-core. Spring Batch 5.1.3 is NOT affected by CVE-2019-3774 (XXE vulnerability). The target version is significantly newer than the affected versions (3.0.9, 4.0.1, 4.1.0). The XXE fix was applied in the upstream codebase in January 2019 (commit edfbdbb82) and later refactored to use Spring Framework's defensive XMLInputFactory in September 2020 (commit 264243b73c). Both commits are ancestors of the TuxCare onboarding commit, meaning the fix was already present in the upstream Spring Batch 5.1.3 release. The target uses StaxUtils.createDefensiveInputFactory() which disables DTD and external entity processing by default, preventing XXE attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.10.RELEASE; >= 4.0.0.RELEASE, < 4.0.2.RELEASE; >= 4.1.0.RELEASE, < 4.1.1.RELEASE), NVD (<= 3.0.9; >= 4.0.0, <= 4.0.1; = 4.1.0), cve.org (>= 4.0, < 4.0.1.RELEASE; >= 4.1, < 4.1.0.RELEASE; >= 3.0, < 3.0.9.RELEASE), Snyk (>= 4.1.0.RELEASE, < 4.1.1.RELEASE; >= 4.0.0.RELEASE, < 4.0.2.RELEASE; >= 3.0.9.RELEASE, < 3.0.10.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3774"
      },
      "impact_statement": "Spring Batch 5.1.3 is NOT affected by CVE-2019-3774 (XXE vulnerability). The target version is significantly newer than the affected versions (3.0.9, 4.0.1, 4.1.0). The XXE fix was applied in the upstream codebase in January 2019 (commit edfbdbb82) and later refactored to use Spring Framework's defensive XMLInputFactory in September 2020 (commit 264243b73c). Both commits are ancestors of the TuxCare onboarding commit, meaning the fix was already present in the upstream Spring Batch 5.1.3 release. The target uses StaxUtils.createDefensiveInputFactory() which disables DTD and external entity processing by default, preventing XXE attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.10.RELEASE; >= 4.0.0.RELEASE, < 4.0.2.RELEASE; >= 4.1.0.RELEASE, < 4.1.1.RELEASE), NVD (<= 3.0.9; >= 4.0.0, <= 4.0.1; = 4.1.0), cve.org (>= 4.0, < 4.0.1.RELEASE; >= 4.1, < 4.1.0.RELEASE; >= 3.0, < 3.0.9.RELEASE), Snyk (>= 4.1.0.RELEASE, < 4.1.1.RELEASE; >= 4.0.0.RELEASE, < 4.0.2.RELEASE; >= 3.0.9.RELEASE, < 3.0.10.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.batch/spring-batch-core@5.1.3-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.batch/spring-batch-core@5.1.3-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-05T14:10:16.547418+00:00",
      "status_notes": "Vulnerability CVE-2020-5411 does not affect version 5.1.3-tuxcare.8 of org.springframework.batch:spring-batch-core. Spring Batch 5.1.3 is not affected by CVE-2020-5411. The vulnerability (unrestricted Jackson deserialization via enableDefaultTyping) was fixed in upstream Spring Batch 4.3.x in June 2020. By the time version 5.1.3 was released upstream, the fix was already present. The target uses a TrustedTypeIdResolver with a whitelist to validate classes during deserialization, preventing arbitrary code execution through deserialization gadgets. The fix was authored by upstream maintainer Mahmoud Ben Hassine (mbenhassine@vmware.com) and was included in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.2.3), NVD (>= 4.0.0, <= 4.0.4; >= 4.1.0, <= 4.1.4; >= 4.2.0, <= 4.2.2), cve.org (>= 4, < 4.2.3), Snyk (>= 4.0.0.RELEASE, < 4.2.3.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5411"
      },
      "impact_statement": "Spring Batch 5.1.3 is not affected by CVE-2020-5411. The vulnerability (unrestricted Jackson deserialization via enableDefaultTyping) was fixed in upstream Spring Batch 4.3.x in June 2020. By the time version 5.1.3 was released upstream, the fix was already present. The target uses a TrustedTypeIdResolver with a whitelist to validate classes during deserialization, preventing arbitrary code execution through deserialization gadgets. The fix was authored by upstream maintainer Mahmoud Ben Hassine (mbenhassine@vmware.com) and was included in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.2.3), NVD (>= 4.0.0, <= 4.0.4; >= 4.1.0, <= 4.1.4; >= 4.2.0, <= 4.2.2), cve.org (>= 4, < 4.2.3), Snyk (>= 4.0.0.RELEASE, < 4.2.3.RELEASE)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.batch/spring-batch-core@5.1.3-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.batch/spring-batch-core@5.1.3-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-05T14:10:16.547418+00:00",
      "status_notes": "Vulnerability CVE-2026-47875 is fixed in version 5.1.3-tuxcare.8 of org.springframework.batch:spring-batch-core.",
      "vulnerability": {
        "name": "CVE-2026-47875"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.batch/spring-batch-core@5.1.3-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.batch/spring-batch-core@5.1.3-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-05T14:10:16.547418+00:00",
      "status_notes": "Vulnerability CVE-2026-47878 is fixed in version 5.1.3-tuxcare.8 of org.springframework.batch:spring-batch-core.",
      "vulnerability": {
        "name": "CVE-2026-47878"
      }
    }
  ]
}