{
  "@id": "urn:uuid:7a9e215f-cbc4-40af-b858-8b55d0e3566c",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 7,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T18:32:00.321693+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-jpa@3.1.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-jpa@3.1.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T18:32:00.321693+00:00",
      "status_notes": "Vulnerability CVE-2016-6652 does not affect version 3.1.8-tuxcare.2 of org.springframework.data:spring-data-jpa. not_affected \u2014 The target spring-data-jpa version 3.1.8 is not affected by CVE-2016-6652. The vulnerability (SQL injection via unvalidated Sort parameters in @Query methods) was fixed in the upstream release via commit 0ae3d435023ff (2021-09-27) by jschauder@vmware.com, which introduced checkSortExpression() validation that rejects sort expressions containing function calls. This fix was already present when ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-6652"
      },
      "impact_statement": "not_affected \u2014 The target spring-data-jpa version 3.1.8 is not affected by CVE-2016-6652. The vulnerability (SQL injection via unvalidated Sort parameters in @Query methods) was fixed in the upstream release via commit 0ae3d435023ff (2021-09-27) by jschauder@vmware.com, which introduced checkSortExpression() validation that rejects sort expressions containing function calls. This fix was already present when ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-jpa@3.1.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-jpa@3.1.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T03:10:00.528664+00:00",
      "status_notes": "Vulnerability CVE-2019-3797 does not affect version 3.1.8-tuxcare.2 of org.springframework.data:spring-data-jpa. not_affected \u2014 Spring Data JPA 3.1.8-tuxcare.3 is NOT affected by CVE-2019-3797. The vulnerability (wildcard injection in LIKE queries allowing information disclosure) was fixed in the upstream Spring Data JPA project in March 2019 via commit 9b16fef6e9a1c8f4352cb979df8ef4a9336d6552 (DATAJPA-1519). This fix introduced the EscapeCharacter class and automatic escaping of SQL wildcards (_,%) in derived queries u...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3797"
      },
      "impact_statement": "not_affected \u2014 Spring Data JPA 3.1.8-tuxcare.3 is NOT affected by CVE-2019-3797. The vulnerability (wildcard injection in LIKE queries allowing information disclosure) was fixed in the upstream Spring Data JPA project in March 2019 via commit 9b16fef6e9a1c8f4352cb979df8ef4a9336d6552 (DATAJPA-1519). This fix introduced the EscapeCharacter class and automatic escaping of SQL wildcards (_,%) in derived queries u..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-jpa@3.1.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-jpa@3.1.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T02:37:37.853216+00:00",
      "status_notes": "Vulnerability CVE-2019-3802 does not affect version 3.1.8-tuxcare.2 of org.springframework.data:spring-data-jpa. not_affected \u2014 The target Spring Data JPA 3.1.8-tuxcare.3 is not affected by CVE-2019-3802. The vulnerability (SQL LIKE wildcard injection via ExampleMatcher) was fixed in upstream releases 1.11.22, 2.0.15, and 2.1.7 (April 2019). Version 3.1.8, released years later, already contains the complete fix in the upstream release that TuxCare onboarded. The vulnerable pattern (unescaped LIKE queries with user-suppl...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3802"
      },
      "impact_statement": "not_affected \u2014 The target Spring Data JPA 3.1.8-tuxcare.3 is not affected by CVE-2019-3802. The vulnerability (SQL LIKE wildcard injection via ExampleMatcher) was fixed in upstream releases 1.11.22, 2.0.15, and 2.1.7 (April 2019). Version 3.1.8, released years later, already contains the complete fix in the upstream release that TuxCare onboarded. The vulnerable pattern (unescaped LIKE queries with user-suppl..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-jpa@3.1.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-jpa@3.1.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-22T09:55:46.504474+00:00",
      "status_notes": "Vulnerability CVE-2026-47834 affects version 3.1.8-tuxcare.2 of org.springframework.data:spring-data-jpa, and is fixed in 3.1.8-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-47834"
      },
      "action_statement": "Vulnerability CVE-2026-47834 affects version 3.1.8-tuxcare.2 of org.springframework.data:spring-data-jpa, and is fixed in 3.1.8-tuxcare.3."
    }
  ]
}