{
  "@id": "urn:uuid:9dd4efe4-97d6-4036-91a9-dfdb8e4dc94d",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 8,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T03:07:00.072461+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-envers@3.2.12-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-envers@3.2.12-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-01T19:34:00.102662+00:00",
      "status_notes": "Vulnerability CVE-2016-6652 affects version 3.2.12-tuxcare.4 of org.springframework.data:spring-data-envers.",
      "vulnerability": {
        "name": "CVE-2016-6652"
      },
      "action_statement": "Vulnerability CVE-2016-6652 affects version 3.2.12-tuxcare.4 of org.springframework.data:spring-data-envers."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-envers@3.2.12-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-envers@3.2.12-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-02T03:07:00.072461+00:00",
      "status_notes": "Vulnerability CVE-2019-3797 does not affect version 3.2.12-tuxcare.4 of org.springframework.data:spring-data-envers. not_affected \u2014 Spring Data JPA 3.2.12 is not affected by CVE-2019-3797. The vulnerability involved missing wildcard escaping in LIKE queries for derived query predicates (contains, startsWith, endsWith) and Query By Example matchers, allowing SQL wildcard injection. The upstream Spring team fixed this in DATAJPA-1519/1522/1534 by introducing the EscapeCharacter class that escapes wildcards (_,%) and the escap...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3797"
      },
      "impact_statement": "not_affected \u2014 Spring Data JPA 3.2.12 is not affected by CVE-2019-3797. The vulnerability involved missing wildcard escaping in LIKE queries for derived query predicates (contains, startsWith, endsWith) and Query By Example matchers, allowing SQL wildcard injection. The upstream Spring team fixed this in DATAJPA-1519/1522/1534 by introducing the EscapeCharacter class that escapes wildcards (_,%) and the escap..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-envers@3.2.12-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-envers@3.2.12-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-02T02:33:45.886475+00:00",
      "status_notes": "Vulnerability CVE-2019-3802 does not affect version 3.2.12-tuxcare.4 of org.springframework.data:spring-data-envers. not_affected \u2014 CVE-2019-3802 affects Spring Data JPA versions up to 2.1.6, 2.0.14, and 1.11.20. The target repository is version 3.2.12-tuxcare.5, which is significantly newer. The vulnerability involved ExampleMatcher string matchers (STARTING, ENDING, CONTAINING) not escaping SQL wildcard characters in user input, allowing attackers to craft malicious example values that return more database rows than inten...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3802"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-3802 affects Spring Data JPA versions up to 2.1.6, 2.0.14, and 1.11.20. The target repository is version 3.2.12-tuxcare.5, which is significantly newer. The vulnerability involved ExampleMatcher string matchers (STARTING, ENDING, CONTAINING) not escaping SQL wildcard characters in user input, allowing attackers to craft malicious example values that return more database rows than inten..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-envers@3.2.12-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-envers@3.2.12-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-28T11:38:32.743366+00:00",
      "status_notes": "Vulnerability CVE-2026-47834 affects version 3.2.12-tuxcare.4 of org.springframework.data:spring-data-envers, and is fixed in 3.2.12-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-47834"
      },
      "action_statement": "Vulnerability CVE-2026-47834 affects version 3.2.12-tuxcare.4 of org.springframework.data:spring-data-envers, and is fixed in 3.2.12-tuxcare.5."
    }
  ]
}