{
  "@id": "urn:uuid:b60f3df3-6f84-426f-8e98-399da60073f6",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 7,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:04:11.456857+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.batch/spring-batch-core@5.2.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.batch/spring-batch-core@5.2.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:06:05.431502+00:00",
      "status_notes": "Vulnerability CVE-2019-3774 does not affect version 5.2.4-tuxcare.1 of org.springframework.batch:spring-batch-core. CVE-2019-3774 (XXE vulnerability in Spring Batch) is not present in this version. The vulnerability was fixed in upstream commit edfbdbb82 (January 2019) by Mahmoud Ben Hassine, which added XXE protection by disabling DTD processing and external entity resolution. This fix was already present in Spring Batch 5.2.4 when TuxCare onboarded it (commit fdc4f023). The current code uses Spring Framework's StaxUtils.createDefensiveInputFactory() which provides the same XXE protection. Test testDtdXml() at line 613 of StaxEventItemReaderTests.java verifies that XXE attacks are properly blocked with \"Undeclared general entity\" error.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.10.RELEASE; >= 4.0.0.RELEASE, < 4.0.2.RELEASE; >= 4.1.0.RELEASE, < 4.1.1.RELEASE), NVD (<= 3.0.9; >= 4.0.0, <= 4.0.1; = 4.1.0), cve.org (>= 4.0, < 4.0.1.RELEASE; >= 4.1, < 4.1.0.RELEASE; >= 3.0, < 3.0.9.RELEASE), Snyk (>= 4.1.0.RELEASE, < 4.1.1.RELEASE; >= 4.0.0.RELEASE, < 4.0.2.RELEASE; >= 3.0.9.RELEASE, < 3.0.10.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3774"
      },
      "impact_statement": "CVE-2019-3774 (XXE vulnerability in Spring Batch) is not present in this version. The vulnerability was fixed in upstream commit edfbdbb82 (January 2019) by Mahmoud Ben Hassine, which added XXE protection by disabling DTD processing and external entity resolution. This fix was already present in Spring Batch 5.2.4 when TuxCare onboarded it (commit fdc4f023). The current code uses Spring Framework's StaxUtils.createDefensiveInputFactory() which provides the same XXE protection. Test testDtdXml() at line 613 of StaxEventItemReaderTests.java verifies that XXE attacks are properly blocked with \"Undeclared general entity\" error.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.10.RELEASE; >= 4.0.0.RELEASE, < 4.0.2.RELEASE; >= 4.1.0.RELEASE, < 4.1.1.RELEASE), NVD (<= 3.0.9; >= 4.0.0, <= 4.0.1; = 4.1.0), cve.org (>= 4.0, < 4.0.1.RELEASE; >= 4.1, < 4.1.0.RELEASE; >= 3.0, < 3.0.9.RELEASE), Snyk (>= 4.1.0.RELEASE, < 4.1.1.RELEASE; >= 4.0.0.RELEASE, < 4.0.2.RELEASE; >= 3.0.9.RELEASE, < 3.0.10.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.batch/spring-batch-core@5.2.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.batch/spring-batch-core@5.2.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:04:11.456857+00:00",
      "status_notes": "Vulnerability CVE-2020-5411 does not affect version 5.2.4-tuxcare.1 of org.springframework.batch:spring-batch-core. CVE-2020-5411 affects Spring Batch's Jackson2ExecutionContextStringSerializer when it uses unrestricted polymorphic deserialization via enableDefaultTyping(). The target version 5.2.4-tuxcare.1 is NOT AFFECTED because the upstream vendor (Spring) already shipped the fix in release 5.2.4, which TuxCare then onboarded. The fix replaces enableDefaultTyping() with a whitelist-based TrustedTypeIdResolver that validates class names during deserialization. The vulnerable pattern is absent from the target; the fix is present and active by default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.2.3), NVD (>= 4.0.0, <= 4.0.4; >= 4.1.0, <= 4.1.4; >= 4.2.0, <= 4.2.2), cve.org (>= 4, < 4.2.3), Snyk (>= 4.0.0.RELEASE, < 4.2.3.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5411"
      },
      "impact_statement": "CVE-2020-5411 affects Spring Batch's Jackson2ExecutionContextStringSerializer when it uses unrestricted polymorphic deserialization via enableDefaultTyping(). The target version 5.2.4-tuxcare.1 is NOT AFFECTED because the upstream vendor (Spring) already shipped the fix in release 5.2.4, which TuxCare then onboarded. The fix replaces enableDefaultTyping() with a whitelist-based TrustedTypeIdResolver that validates class names during deserialization. The vulnerable pattern is absent from the target; the fix is present and active by default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.2.3), NVD (>= 4.0.0, <= 4.0.4; >= 4.1.0, <= 4.1.4; >= 4.2.0, <= 4.2.2), cve.org (>= 4, < 4.2.3), Snyk (>= 4.0.0.RELEASE, < 4.2.3.RELEASE)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.batch/spring-batch-core@5.2.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.batch/spring-batch-core@5.2.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-14T06:03:47.872881+00:00",
      "status_notes": "Vulnerability CVE-2026-47875 is fixed in version 5.2.4-tuxcare.1 of org.springframework.batch:spring-batch-core.",
      "vulnerability": {
        "name": "CVE-2026-47875"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.batch/spring-batch-core@5.2.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.batch/spring-batch-core@5.2.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-14T06:03:47.872881+00:00",
      "status_notes": "Vulnerability CVE-2026-47878 is fixed in version 5.2.4-tuxcare.1 of org.springframework.batch:spring-batch-core.",
      "vulnerability": {
        "name": "CVE-2026-47878"
      }
    }
  ]
}