{
  "@id": "urn:uuid:9920a2ec-e217-4804-b59c-db6d435534b5",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 6,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T18:30:22.525196+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-jpa@3.3.12-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-jpa@3.3.12-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T18:30:22.525196+00:00",
      "status_notes": "Vulnerability CVE-2016-6652 does not affect version 3.3.12-tuxcare.3 of org.springframework.data:spring-data-jpa. not_affected \u2014 CVE-2016-6652 (DATAJPA-965) SQL injection vulnerability is not present in spring-data-jpa 3.3.12-tuxcare.3. The fix was already included in the upstream Spring Data JPA 3.3.12 release that TuxCare onboarded. The vulnerability allowed attackers to inject arbitrary JPQL commands via Sort parameters with function calls when used with @Query annotations. The upstream fix (commits b8e7feccc and 5c41...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-6652"
      },
      "impact_statement": "not_affected \u2014 CVE-2016-6652 (DATAJPA-965) SQL injection vulnerability is not present in spring-data-jpa 3.3.12-tuxcare.3. The fix was already included in the upstream Spring Data JPA 3.3.12 release that TuxCare onboarded. The vulnerability allowed attackers to inject arbitrary JPQL commands via Sort parameters with function calls when used with @Query annotations. The upstream fix (commits b8e7feccc and 5c41..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-jpa@3.3.12-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-jpa@3.3.12-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T03:08:00.122443+00:00",
      "status_notes": "Vulnerability CVE-2019-3797 does not affect version 3.3.12-tuxcare.3 of org.springframework.data:spring-data-jpa. not_affected \u2014 The target repository (spring-data-jpa version 3.3.12-tuxcare.3) is NOT AFFECTED by CVE-2019-3797. The vulnerability concerns wildcard injection in LIKE queries where user input containing SQL wildcards (_ and %) could match more database rows than intended. The complete fix for this vulnerability was already present in upstream version 3.3.12 before TuxCare onboarded it. The fix includes: (1) ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3797"
      },
      "impact_statement": "not_affected \u2014 The target repository (spring-data-jpa version 3.3.12-tuxcare.3) is NOT AFFECTED by CVE-2019-3797. The vulnerability concerns wildcard injection in LIKE queries where user input containing SQL wildcards (_ and %) could match more database rows than intended. The complete fix for this vulnerability was already present in upstream version 3.3.12 before TuxCare onboarded it. The fix includes: (1) ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-jpa@3.3.12-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-jpa@3.3.12-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T02:32:55.739745+00:00",
      "status_notes": "Vulnerability CVE-2019-3802 does not affect version 3.3.12-tuxcare.3 of org.springframework.data:spring-data-jpa. not_affected \u2014 Spring Data JPA 3.3.12-tuxcare.3 is NOT AFFECTED by CVE-2019-3802. The vulnerability (wildcard injection in Query By Example LIKE patterns) was fixed in upstream Spring Data JPA before the 3.3.12 release. The fix (commit 075b4bad6) escapes SQL wildcards and the escape character itself in user-supplied strings for CONTAINING/STARTING/ENDING matchers. The fix is active by default (EscapeCharacter...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3802"
      },
      "impact_statement": "not_affected \u2014 Spring Data JPA 3.3.12-tuxcare.3 is NOT AFFECTED by CVE-2019-3802. The vulnerability (wildcard injection in Query By Example LIKE patterns) was fixed in upstream Spring Data JPA before the 3.3.12 release. The fix (commit 075b4bad6) escapes SQL wildcards and the escape character itself in user-supplied strings for CONTAINING/STARTING/ENDING matchers. The fix is active by default (EscapeCharacter..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-jpa@3.3.12-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-jpa@3.3.12-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-19T17:02:00.141161+00:00",
      "status_notes": "Vulnerability CVE-2026-47834 is fixed in version 3.3.12-tuxcare.3 of org.springframework.data:spring-data-jpa.",
      "vulnerability": {
        "name": "CVE-2026-47834"
      }
    }
  ]
}