{
  "@id": "urn:uuid:cef3c457-f9b4-4f5c-8efb-4c007b63364b",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 7,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:04:11.456857+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.batch/spring-batch-core@5.2.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.batch/spring-batch-core@5.2.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:05:17.011429+00:00",
      "status_notes": "Vulnerability CVE-2019-3774 does not affect version 5.2.6-tuxcare.2 of org.springframework.batch:spring-batch-core. CVE-2019-3774 (XXE vulnerability in Spring Batch) is NOT present in the target. The target uses Spring Framework's StaxUtils.createDefensiveInputFactory() which provides XXE protection by disabling DTD processing and external entity resolution. This fix was already present in the upstream Spring Batch 5.2.6 release that TuxCare onboarded (commit e989af72d). The fixing commit (264243b73) was authored by upstream maintainer Mahmoud Ben Hassine, not TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.10.RELEASE; >= 4.0.0.RELEASE, < 4.0.2.RELEASE; >= 4.1.0.RELEASE, < 4.1.1.RELEASE), NVD (<= 3.0.9; >= 4.0.0, <= 4.0.1; = 4.1.0), cve.org (>= 4.0, < 4.0.1.RELEASE; >= 4.1, < 4.1.0.RELEASE; >= 3.0, < 3.0.9.RELEASE), Snyk (>= 4.1.0.RELEASE, < 4.1.1.RELEASE; >= 4.0.0.RELEASE, < 4.0.2.RELEASE; >= 3.0.9.RELEASE, < 3.0.10.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3774"
      },
      "impact_statement": "CVE-2019-3774 (XXE vulnerability in Spring Batch) is NOT present in the target. The target uses Spring Framework's StaxUtils.createDefensiveInputFactory() which provides XXE protection by disabling DTD processing and external entity resolution. This fix was already present in the upstream Spring Batch 5.2.6 release that TuxCare onboarded (commit e989af72d). The fixing commit (264243b73) was authored by upstream maintainer Mahmoud Ben Hassine, not TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.10.RELEASE; >= 4.0.0.RELEASE, < 4.0.2.RELEASE; >= 4.1.0.RELEASE, < 4.1.1.RELEASE), NVD (<= 3.0.9; >= 4.0.0, <= 4.0.1; = 4.1.0), cve.org (>= 4.0, < 4.0.1.RELEASE; >= 4.1, < 4.1.0.RELEASE; >= 3.0, < 3.0.9.RELEASE), Snyk (>= 4.1.0.RELEASE, < 4.1.1.RELEASE; >= 4.0.0.RELEASE, < 4.0.2.RELEASE; >= 3.0.9.RELEASE, < 3.0.10.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.batch/spring-batch-core@5.2.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.batch/spring-batch-core@5.2.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:04:11.456857+00:00",
      "status_notes": "Vulnerability CVE-2020-5411 does not affect version 5.2.6-tuxcare.2 of org.springframework.batch:spring-batch-core. CVE-2020-5411 addresses a Jackson deserialization vulnerability in Spring Batch where default typing enabled arbitrary code execution through malicious gadget classes. The target Spring Batch 5.2.6-tuxcare.3 is NOT AFFECTED because the fix was already present in the upstream Spring Batch 5.2.6 release that TuxCare onboarded. The vulnerable code pattern (unrestricted `enableDefaultTyping()`) was replaced with a whitelist-based `TrustedTypeIdResolver` that validates all deserialized classes against a trusted set, implemented by upstream Spring maintainer Mahmoud Ben Hassine in commit 9a79b4572d0aa4bec38fe90957c850920b7f9cea on June 10, 2020.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.2.3), NVD (>= 4.0.0, <= 4.0.4; >= 4.1.0, <= 4.1.4; >= 4.2.0, <= 4.2.2), cve.org (>= 4, < 4.2.3), Snyk (>= 4.0.0.RELEASE, < 4.2.3.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5411"
      },
      "impact_statement": "CVE-2020-5411 addresses a Jackson deserialization vulnerability in Spring Batch where default typing enabled arbitrary code execution through malicious gadget classes. The target Spring Batch 5.2.6-tuxcare.3 is NOT AFFECTED because the fix was already present in the upstream Spring Batch 5.2.6 release that TuxCare onboarded. The vulnerable code pattern (unrestricted `enableDefaultTyping()`) was replaced with a whitelist-based `TrustedTypeIdResolver` that validates all deserialized classes against a trusted set, implemented by upstream Spring maintainer Mahmoud Ben Hassine in commit 9a79b4572d0aa4bec38fe90957c850920b7f9cea on June 10, 2020.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.2.3), NVD (>= 4.0.0, <= 4.0.4; >= 4.1.0, <= 4.1.4; >= 4.2.0, <= 4.2.2), cve.org (>= 4, < 4.2.3), Snyk (>= 4.0.0.RELEASE, < 4.2.3.RELEASE)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.batch/spring-batch-core@5.2.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.batch/spring-batch-core@5.2.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-13T18:57:00.241959+00:00",
      "status_notes": "Vulnerability CVE-2026-47875 affects version 5.2.6-tuxcare.2 of org.springframework.batch:spring-batch-core, and is fixed in 5.2.6-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-47875"
      },
      "action_statement": "Vulnerability CVE-2026-47875 affects version 5.2.6-tuxcare.2 of org.springframework.batch:spring-batch-core, and is fixed in 5.2.6-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.batch/spring-batch-core@5.2.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.batch/spring-batch-core@5.2.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-13T18:57:00.241959+00:00",
      "status_notes": "Vulnerability CVE-2026-47878 affects version 5.2.6-tuxcare.2 of org.springframework.batch:spring-batch-core, and is fixed in 5.2.6-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-47878"
      },
      "action_statement": "Vulnerability CVE-2026-47878 affects version 5.2.6-tuxcare.2 of org.springframework.batch:spring-batch-core, and is fixed in 5.2.6-tuxcare.3."
    }
  ]
}