{
  "@id": "urn:uuid:1723e249-02fc-49a5-a6bf-2ca9cdf9ce5f",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 7,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T18:30:22.525196+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-jpa@3.2.12-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-jpa@3.2.12-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-02T18:30:22.525196+00:00",
      "status_notes": "Vulnerability CVE-2016-6652 does not affect version 3.2.12-tuxcare.5 of org.springframework.data:spring-data-jpa. not_affected \u2014 The target spring-data-jpa 3.2.12-tuxcare.5 is NOT AFFECTED by CVE-2016-6652. The upstream vendor (Pivotal) fixed this SQL injection vulnerability in September 2016 (commit b8e7feccc), and the fix was already present in the upstream 3.2.12 release when TuxCare onboarded it in 2024. The fix adds validation to reject Sort expressions containing function calls (e.g., \"LENGTH(firstname)\") unless ex...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-6652"
      },
      "impact_statement": "not_affected \u2014 The target spring-data-jpa 3.2.12-tuxcare.5 is NOT AFFECTED by CVE-2016-6652. The upstream vendor (Pivotal) fixed this SQL injection vulnerability in September 2016 (commit b8e7feccc), and the fix was already present in the upstream 3.2.12 release when TuxCare onboarded it in 2024. The fix adds validation to reject Sort expressions containing function calls (e.g., \"LENGTH(firstname)\") unless ex..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-jpa@3.2.12-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-jpa@3.2.12-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-02T03:07:00.072461+00:00",
      "status_notes": "Vulnerability CVE-2019-3797 does not affect version 3.2.12-tuxcare.5 of org.springframework.data:spring-data-jpa. not_affected \u2014 Spring Data JPA 3.2.12 is not affected by CVE-2019-3797. The vulnerability involved missing wildcard escaping in LIKE queries for derived query predicates (contains, startsWith, endsWith) and Query By Example matchers, allowing SQL wildcard injection. The upstream Spring team fixed this in DATAJPA-1519/1522/1534 by introducing the EscapeCharacter class that escapes wildcards (_,%) and the escap...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3797"
      },
      "impact_statement": "not_affected \u2014 Spring Data JPA 3.2.12 is not affected by CVE-2019-3797. The vulnerability involved missing wildcard escaping in LIKE queries for derived query predicates (contains, startsWith, endsWith) and Query By Example matchers, allowing SQL wildcard injection. The upstream Spring team fixed this in DATAJPA-1519/1522/1534 by introducing the EscapeCharacter class that escapes wildcards (_,%) and the escap..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-jpa@3.2.12-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-jpa@3.2.12-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-02T02:33:45.886475+00:00",
      "status_notes": "Vulnerability CVE-2019-3802 does not affect version 3.2.12-tuxcare.5 of org.springframework.data:spring-data-jpa. not_affected \u2014 CVE-2019-3802 affects Spring Data JPA versions up to 2.1.6, 2.0.14, and 1.11.20. The target repository is version 3.2.12-tuxcare.5, which is significantly newer. The vulnerability involved ExampleMatcher string matchers (STARTING, ENDING, CONTAINING) not escaping SQL wildcard characters in user input, allowing attackers to craft malicious example values that return more database rows than inten...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3802"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-3802 affects Spring Data JPA versions up to 2.1.6, 2.0.14, and 1.11.20. The target repository is version 3.2.12-tuxcare.5, which is significantly newer. The vulnerability involved ExampleMatcher string matchers (STARTING, ENDING, CONTAINING) not escaping SQL wildcard characters in user input, allowing attackers to craft malicious example values that return more database rows than inten..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-jpa@3.2.12-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-jpa@3.2.12-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-28T11:38:32.743366+00:00",
      "status_notes": "Vulnerability CVE-2026-47834 is fixed in version 3.2.12-tuxcare.5 of org.springframework.data:spring-data-jpa.",
      "vulnerability": {
        "name": "CVE-2026-47834"
      }
    }
  ]
}