{
  "@id": "urn:uuid:a0ba0274-82a5-41e1-8988-8f6baf4de468",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 7,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T03:17:00.149533+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-envers@3.0.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-envers@3.0.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T19:34:00.102662+00:00",
      "status_notes": "Vulnerability CVE-2016-6652 affects version 3.0.12-tuxcare.2 of org.springframework.data:spring-data-envers.",
      "vulnerability": {
        "name": "CVE-2016-6652"
      },
      "action_statement": "Vulnerability CVE-2016-6652 affects version 3.0.12-tuxcare.2 of org.springframework.data:spring-data-envers."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-envers@3.0.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-envers@3.0.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T03:17:00.149533+00:00",
      "status_notes": "Vulnerability CVE-2019-3797 does not affect version 3.0.12-tuxcare.2 of org.springframework.data:spring-data-envers. not_affected \u2014 The target spring-data-jpa version 3.0.12 is NOT affected by CVE-2019-3797. The vulnerability affected versions up to 2.1.5, 2.0.13, and 1.11.19. The complete fix for wildcard escaping in LIKE queries was already present in the upstream Spring Data JPA 3.0.12 release when TuxCare onboarded it. The fix includes the EscapeCharacter class with proper escaping of SQL wildcards (_, %) and the escape...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3797"
      },
      "impact_statement": "not_affected \u2014 The target spring-data-jpa version 3.0.12 is NOT affected by CVE-2019-3797. The vulnerability affected versions up to 2.1.5, 2.0.13, and 1.11.19. The complete fix for wildcard escaping in LIKE queries was already present in the upstream Spring Data JPA 3.0.12 release when TuxCare onboarded it. The fix includes the EscapeCharacter class with proper escaping of SQL wildcards (_, %) and the escape..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-envers@3.0.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-envers@3.0.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T02:42:44.518665+00:00",
      "status_notes": "Vulnerability CVE-2019-3802 does not affect version 3.0.12-tuxcare.2 of org.springframework.data:spring-data-envers. not_affected \u2014 CVE-2019-3802 is NOT present in spring-data-jpa 3.0.12-tuxcare.2. The vulnerability affecting ExampleMatcher with STARTING/ENDING/CONTAINING string matchers has been fixed in the upstream release. The fix (DATAJPA-1534, commit 075b4bad6) was committed by the Spring team on 2019-04-26 and was already present in upstream version 3.0.12 when TuxCare onboarded it on 2026-07-30. All three vulnerable...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3802"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-3802 is NOT present in spring-data-jpa 3.0.12-tuxcare.2. The vulnerability affecting ExampleMatcher with STARTING/ENDING/CONTAINING string matchers has been fixed in the upstream release. The fix (DATAJPA-1534, commit 075b4bad6) was committed by the Spring team on 2019-04-26 and was already present in upstream version 3.0.12 when TuxCare onboarded it on 2026-07-30. All three vulnerable..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-envers@3.0.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-envers@3.0.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-22T11:34:41.878995+00:00",
      "status_notes": "Vulnerability CVE-2026-47834 is fixed in version 3.0.12-tuxcare.2 of org.springframework.data:spring-data-envers.",
      "vulnerability": {
        "name": "CVE-2026-47834"
      }
    }
  ]
}