{
  "@id": "urn:uuid:ec553b1c-f6ef-45e1-bb2e-420203869381",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 6,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T18:31:00.090719+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-jpa@2.7.16-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-jpa@2.7.16-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T18:31:00.090719+00:00",
      "status_notes": "Vulnerability CVE-2016-6652 does not affect version 2.7.16-tuxcare.1 of org.springframework.data:spring-data-jpa. not_affected \u2014 CVE-2016-6652 is NOT present in spring-data-jpa 2.7.16-tuxcare.3. The vulnerability pattern was fixed by upstream developers and shipped in the upstream 2.7.16 release that TuxCare onboarded. The fix (DATAJPA-965) adds input validation via checkSortExpression() that rejects Sort order properties containing punctuation characters (except . and _) that could enable SQL injection through function ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-6652"
      },
      "impact_statement": "not_affected \u2014 CVE-2016-6652 is NOT present in spring-data-jpa 2.7.16-tuxcare.3. The vulnerability pattern was fixed by upstream developers and shipped in the upstream 2.7.16 release that TuxCare onboarded. The fix (DATAJPA-965) adds input validation via checkSortExpression() that rejects Sort order properties containing punctuation characters (except . and _) that could enable SQL injection through function ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-jpa@2.7.16-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-jpa@2.7.16-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T03:11:00.243108+00:00",
      "status_notes": "Vulnerability CVE-2019-3797 does not affect version 2.7.16-tuxcare.1 of org.springframework.data:spring-data-jpa. not_affected \u2014 Target version 2.7.16-tuxcare.3 is not affected by CVE-2019-3797. The vulnerability (unescaped SQL wildcards in LIKE queries) was fixed by upstream Spring Data JPA team in releases 2.1.6+ and 2.2.0+. All fixes (DATAJPA-1519, DATAJPA-1522, DATAJPA-1534) were already present in upstream 2.7.16 when TuxCare onboarded it. The EscapeCharacter class properly escapes the escape character itself before...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3797"
      },
      "impact_statement": "not_affected \u2014 Target version 2.7.16-tuxcare.3 is not affected by CVE-2019-3797. The vulnerability (unescaped SQL wildcards in LIKE queries) was fixed by upstream Spring Data JPA team in releases 2.1.6+ and 2.2.0+. All fixes (DATAJPA-1519, DATAJPA-1522, DATAJPA-1534) were already present in upstream 2.7.16 when TuxCare onboarded it. The EscapeCharacter class properly escapes the escape character itself before..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-jpa@2.7.16-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-jpa@2.7.16-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T02:37:37.853216+00:00",
      "status_notes": "Vulnerability CVE-2019-3802 does not affect version 2.7.16-tuxcare.1 of org.springframework.data:spring-data-jpa. not_affected \u2014 The target (spring-data-jpa 2.7.16-tuxcare.3) is NOT AFFECTED by CVE-2019-3802. The vulnerability\u2014which allowed maliciously crafted example values containing SQL LIKE wildcard characters (%, _) or escape characters (\\) to return more database results than intended\u2014has been fixed in the upstream Spring Data JPA 2.7.16 release that TuxCare onboarded. The fix was authored by Jens Schauder (jschaud...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3802"
      },
      "impact_statement": "not_affected \u2014 The target (spring-data-jpa 2.7.16-tuxcare.3) is NOT AFFECTED by CVE-2019-3802. The vulnerability\u2014which allowed maliciously crafted example values containing SQL LIKE wildcard characters (%, _) or escape characters (\\) to return more database results than intended\u2014has been fixed in the upstream Spring Data JPA 2.7.16 release that TuxCare onboarded. The fix was authored by Jens Schauder (jschaud..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-jpa@2.7.16-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-jpa@2.7.16-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T18:40:55.741562+00:00",
      "status_notes": "Vulnerability CVE-2026-47834 affects version 2.7.16-tuxcare.1 of org.springframework.data:spring-data-jpa.",
      "vulnerability": {
        "name": "CVE-2026-47834"
      },
      "action_statement": "Vulnerability CVE-2026-47834 affects version 2.7.16-tuxcare.1 of org.springframework.data:spring-data-jpa."
    }
  ]
}