{
  "@id": "urn:uuid:5dfc164b-e83f-4356-8a47-48289a301ded",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 8,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T03:10:00.528664+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-envers@3.1.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-envers@3.1.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T19:34:00.102662+00:00",
      "status_notes": "Vulnerability CVE-2016-6652 affects version 3.1.8-tuxcare.2 of org.springframework.data:spring-data-envers.",
      "vulnerability": {
        "name": "CVE-2016-6652"
      },
      "action_statement": "Vulnerability CVE-2016-6652 affects version 3.1.8-tuxcare.2 of org.springframework.data:spring-data-envers."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-envers@3.1.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-envers@3.1.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T03:10:00.528664+00:00",
      "status_notes": "Vulnerability CVE-2019-3797 does not affect version 3.1.8-tuxcare.2 of org.springframework.data:spring-data-envers. not_affected \u2014 Spring Data JPA 3.1.8-tuxcare.3 is NOT affected by CVE-2019-3797. The vulnerability (wildcard injection in LIKE queries allowing information disclosure) was fixed in the upstream Spring Data JPA project in March 2019 via commit 9b16fef6e9a1c8f4352cb979df8ef4a9336d6552 (DATAJPA-1519). This fix introduced the EscapeCharacter class and automatic escaping of SQL wildcards (_,%) in derived queries u...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3797"
      },
      "impact_statement": "not_affected \u2014 Spring Data JPA 3.1.8-tuxcare.3 is NOT affected by CVE-2019-3797. The vulnerability (wildcard injection in LIKE queries allowing information disclosure) was fixed in the upstream Spring Data JPA project in March 2019 via commit 9b16fef6e9a1c8f4352cb979df8ef4a9336d6552 (DATAJPA-1519). This fix introduced the EscapeCharacter class and automatic escaping of SQL wildcards (_,%) in derived queries u..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-envers@3.1.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-envers@3.1.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T02:37:37.853216+00:00",
      "status_notes": "Vulnerability CVE-2019-3802 does not affect version 3.1.8-tuxcare.2 of org.springframework.data:spring-data-envers. not_affected \u2014 The target Spring Data JPA 3.1.8-tuxcare.3 is not affected by CVE-2019-3802. The vulnerability (SQL LIKE wildcard injection via ExampleMatcher) was fixed in upstream releases 1.11.22, 2.0.15, and 2.1.7 (April 2019). Version 3.1.8, released years later, already contains the complete fix in the upstream release that TuxCare onboarded. The vulnerable pattern (unescaped LIKE queries with user-suppl...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3802"
      },
      "impact_statement": "not_affected \u2014 The target Spring Data JPA 3.1.8-tuxcare.3 is not affected by CVE-2019-3802. The vulnerability (SQL LIKE wildcard injection via ExampleMatcher) was fixed in upstream releases 1.11.22, 2.0.15, and 2.1.7 (April 2019). Version 3.1.8, released years later, already contains the complete fix in the upstream release that TuxCare onboarded. The vulnerable pattern (unescaped LIKE queries with user-suppl..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-envers@3.1.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-envers@3.1.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-22T09:55:46.504474+00:00",
      "status_notes": "Vulnerability CVE-2026-47834 affects version 3.1.8-tuxcare.2 of org.springframework.data:spring-data-envers, and is fixed in 3.1.8-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-47834"
      },
      "action_statement": "Vulnerability CVE-2026-47834 affects version 3.1.8-tuxcare.2 of org.springframework.data:spring-data-envers, and is fixed in 3.1.8-tuxcare.3."
    }
  ]
}