{
  "@id": "urn:uuid:a220b547-a434-48eb-8569-d1664fd8f216",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T10:27:11.003578+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-jpa@2.1.21.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-jpa@2.1.21.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T10:27:11.003578+00:00",
      "status_notes": "Vulnerability CVE-2016-6652 does not affect version 2.1.21.RELEASE-tuxcare.1 of org.springframework.data:spring-data-jpa. not_affected \u2014 CVE-2016-6652 does NOT affect spring-data-jpa version 2.1.21.RELEASE. The vulnerability allowed SQL injection via Sort parameters containing function calls in @Query-annotated repository methods. The upstream vendor (Pivotal/Spring) fixed this in version 1.11.0.RC1 (commit b8e7feccc, September 2016) by adding validation that rejects Sort properties containing punctuation or whitespace unless ex...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-6652"
      },
      "impact_statement": "not_affected \u2014 CVE-2016-6652 does NOT affect spring-data-jpa version 2.1.21.RELEASE. The vulnerability allowed SQL injection via Sort parameters containing function calls in @Query-annotated repository methods. The upstream vendor (Pivotal/Spring) fixed this in version 1.11.0.RC1 (commit b8e7feccc, September 2016) by adding validation that rejects Sort properties containing punctuation or whitespace unless ex..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-jpa@2.1.21.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-jpa@2.1.21.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T10:27:11.003578+00:00",
      "status_notes": "Vulnerability CVE-2019-3797 does not affect version 2.1.21.RELEASE-tuxcare.1 of org.springframework.data:spring-data-jpa. not_affected \u2014 The target Spring Data JPA 2.1.21.RELEASE is not affected by CVE-2019-3797. The vulnerability (SQL LIKE wildcard injection via unescaped % and _ characters in query parameters) was fixed in upstream Spring Data JPA before version 2.1.21.RELEASE was released. The fix introduces an EscapeCharacter class that escapes SQL wildcards in derived query predicates (startingWith/endingWith/containing) an...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3797"
      },
      "impact_statement": "not_affected \u2014 The target Spring Data JPA 2.1.21.RELEASE is not affected by CVE-2019-3797. The vulnerability (SQL LIKE wildcard injection via unescaped % and _ characters in query parameters) was fixed in upstream Spring Data JPA before version 2.1.21.RELEASE was released. The fix introduces an EscapeCharacter class that escapes SQL wildcards in derived query predicates (startingWith/endingWith/containing) an..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-jpa@2.1.21.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-jpa@2.1.21.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T10:27:11.003578+00:00",
      "status_notes": "Vulnerability CVE-2019-3802 does not affect version 2.1.21.RELEASE-tuxcare.1 of org.springframework.data:spring-data-jpa. not_affected \u2014 Spring Data JPA version 2.1.21.RELEASE is not affected by CVE-2019-3802. The vulnerability (wildcard injection in Query By Example string matchers allowing over-disclosure of database records) was fixed by upstream Spring in commit d5f88165069fb53c3d034559cc2873e9a9a95633 (DATAJPA-1534, dated April 26, 2019). This fix was already present in the 2.1.21.RELEASE version that TuxCare onboarded on O...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3802"
      },
      "impact_statement": "not_affected \u2014 Spring Data JPA version 2.1.21.RELEASE is not affected by CVE-2019-3802. The vulnerability (wildcard injection in Query By Example string matchers allowing over-disclosure of database records) was fixed by upstream Spring in commit d5f88165069fb53c3d034559cc2873e9a9a95633 (DATAJPA-1534, dated April 26, 2019). This fix was already present in the 2.1.21.RELEASE version that TuxCare onboarded on O..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-jpa@2.1.21.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-jpa@2.1.21.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T10:27:11.003578+00:00",
      "status_notes": "Vulnerability CVE-2026-47834 affects version 2.1.21.RELEASE-tuxcare.1 of org.springframework.data:spring-data-jpa.",
      "vulnerability": {
        "name": "CVE-2026-47834"
      },
      "action_statement": "Vulnerability CVE-2026-47834 affects version 2.1.21.RELEASE-tuxcare.1 of org.springframework.data:spring-data-jpa."
    }
  ]
}