{
  "@id": "urn:uuid:cf28a45b-8aad-45f1-a36a-24be2fab8b69",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 7,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T18:32:00.321693+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-jpa@3.0.12-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-jpa@3.0.12-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T18:32:00.321693+00:00",
      "status_notes": "Vulnerability CVE-2016-6652 does not affect version 3.0.12-tuxcare.1 of org.springframework.data:spring-data-jpa. not_affected \u2014 CVE-2016-6652 is not present in Spring Data JPA 3.0.12. The vulnerability (SQL injection via Sort parameters with function calls) was fixed by upstream commit b8e7feccc in September 2016 (DATAJPA-965). This fix shipped in upstream Spring Data JPA releases long before version 3.0.12 was released in 2022. TuxCare onboarded the already-fixed version 3.0.12, which contains the complete defense: che...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-6652"
      },
      "impact_statement": "not_affected \u2014 CVE-2016-6652 is not present in Spring Data JPA 3.0.12. The vulnerability (SQL injection via Sort parameters with function calls) was fixed by upstream commit b8e7feccc in September 2016 (DATAJPA-965). This fix shipped in upstream Spring Data JPA releases long before version 3.0.12 was released in 2022. TuxCare onboarded the already-fixed version 3.0.12, which contains the complete defense: che..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-jpa@3.0.12-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-jpa@3.0.12-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T03:17:00.149533+00:00",
      "status_notes": "Vulnerability CVE-2019-3797 does not affect version 3.0.12-tuxcare.1 of org.springframework.data:spring-data-jpa. not_affected \u2014 The target spring-data-jpa version 3.0.12 is NOT affected by CVE-2019-3797. The vulnerability affected versions up to 2.1.5, 2.0.13, and 1.11.19. The complete fix for wildcard escaping in LIKE queries was already present in the upstream Spring Data JPA 3.0.12 release when TuxCare onboarded it. The fix includes the EscapeCharacter class with proper escaping of SQL wildcards (_, %) and the escape...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3797"
      },
      "impact_statement": "not_affected \u2014 The target spring-data-jpa version 3.0.12 is NOT affected by CVE-2019-3797. The vulnerability affected versions up to 2.1.5, 2.0.13, and 1.11.19. The complete fix for wildcard escaping in LIKE queries was already present in the upstream Spring Data JPA 3.0.12 release when TuxCare onboarded it. The fix includes the EscapeCharacter class with proper escaping of SQL wildcards (_, %) and the escape..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-jpa@3.0.12-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-jpa@3.0.12-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T02:42:44.518665+00:00",
      "status_notes": "Vulnerability CVE-2019-3802 does not affect version 3.0.12-tuxcare.1 of org.springframework.data:spring-data-jpa. not_affected \u2014 CVE-2019-3802 is NOT present in spring-data-jpa 3.0.12-tuxcare.2. The vulnerability affecting ExampleMatcher with STARTING/ENDING/CONTAINING string matchers has been fixed in the upstream release. The fix (DATAJPA-1534, commit 075b4bad6) was committed by the Spring team on 2019-04-26 and was already present in upstream version 3.0.12 when TuxCare onboarded it on 2026-07-30. All three vulnerable...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3802"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-3802 is NOT present in spring-data-jpa 3.0.12-tuxcare.2. The vulnerability affecting ExampleMatcher with STARTING/ENDING/CONTAINING string matchers has been fixed in the upstream release. The fix (DATAJPA-1534, commit 075b4bad6) was committed by the Spring team on 2019-04-26 and was already present in upstream version 3.0.12 when TuxCare onboarded it on 2026-07-30. All three vulnerable..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-jpa@3.0.12-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-jpa@3.0.12-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T11:34:41.878995+00:00",
      "status_notes": "Vulnerability CVE-2026-47834 affects version 3.0.12-tuxcare.1 of org.springframework.data:spring-data-jpa, and is fixed in 3.0.12-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-47834"
      },
      "action_statement": "Vulnerability CVE-2026-47834 affects version 3.0.12-tuxcare.1 of org.springframework.data:spring-data-jpa, and is fixed in 3.0.12-tuxcare.2."
    }
  ]
}