{
  "@id": "urn:uuid:9e7126d1-f5e2-4f96-ad87-f6cffe53506f",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 9,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T03:13:02.428460+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-envers@3.5.13-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-envers@3.5.13-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T19:34:00.102662+00:00",
      "status_notes": "Vulnerability CVE-2016-6652 affects version 3.5.13-tuxcare.1 of org.springframework.data:spring-data-envers.",
      "vulnerability": {
        "name": "CVE-2016-6652"
      },
      "action_statement": "Vulnerability CVE-2016-6652 affects version 3.5.13-tuxcare.1 of org.springframework.data:spring-data-envers."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-envers@3.5.13-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-envers@3.5.13-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T03:13:02.428460+00:00",
      "status_notes": "Vulnerability CVE-2019-3797 does not affect version 3.5.13-tuxcare.1 of org.springframework.data:spring-data-envers. not_affected \u2014 CVE-2019-3797 is not present in Spring Data JPA 3.5.13-tuxcare.4. The vulnerability affected derived queries with `startingWith`, `endingWith`, or `containing` predicates, allowing maliciously crafted parameters with SQL LIKE wildcards (`_`, `%`) to return more results than intended. The upstream fix (DATAJPA-1519) introduced the EscapeCharacter class and escaping logic throughout the query exe...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3797"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-3797 is not present in Spring Data JPA 3.5.13-tuxcare.4. The vulnerability affected derived queries with `startingWith`, `endingWith`, or `containing` predicates, allowing maliciously crafted parameters with SQL LIKE wildcards (`_`, `%`) to return more results than intended. The upstream fix (DATAJPA-1519) introduced the EscapeCharacter class and escaping logic throughout the query exe..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-envers@3.5.13-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-envers@3.5.13-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T02:37:37.853216+00:00",
      "status_notes": "Vulnerability CVE-2019-3802 does not affect version 3.5.13-tuxcare.1 of org.springframework.data:spring-data-envers. not_affected \u2014 CVE-2019-3802 is NOT present in spring-data-jpa 3.5.13-tuxcare.4. The vulnerability (SQL wildcard injection in ExampleMatcher LIKE queries) was fixed by upstream Spring Data JPA in the 3.5.13 release that TuxCare subsequently onboarded. The fix properly escapes SQL LIKE wildcards (%, _) and the escape character (\\) in user-supplied values before constructing query predicates. Both components of...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3802"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-3802 is NOT present in spring-data-jpa 3.5.13-tuxcare.4. The vulnerability (SQL wildcard injection in ExampleMatcher LIKE queries) was fixed by upstream Spring Data JPA in the 3.5.13 release that TuxCare subsequently onboarded. The fix properly escapes SQL LIKE wildcards (%, _) and the escape character (\\) in user-supplied values before constructing query predicates. Both components of..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-envers@3.5.13-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-envers@3.5.13-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-14T13:24:00.156683+00:00",
      "status_notes": "Vulnerability CVE-2026-47834 affects version 3.5.13-tuxcare.1 of org.springframework.data:spring-data-envers, and is fixed in 3.5.13-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-47834"
      },
      "action_statement": "Vulnerability CVE-2026-47834 affects version 3.5.13-tuxcare.1 of org.springframework.data:spring-data-envers, and is fixed in 3.5.13-tuxcare.3."
    }
  ]
}