{
  "@id": "urn:uuid:f9b8e092-8b62-4fe2-b805-1aae21a88218",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 6,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T18:32:00.321693+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-jpa@3.4.12-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-jpa@3.4.12-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T18:32:00.321693+00:00",
      "status_notes": "Vulnerability CVE-2016-6652 does not affect version 3.4.12-tuxcare.1 of org.springframework.data:spring-data-jpa. not_affected \u2014 CVE-2016-6652 (DATAJPA-965) SQL injection vulnerability is NOT present in spring-data-jpa 3.4.12. The fix was committed by Pivotal engineers (Christoph Strobl, Oliver Gierke) in September 2016 and shipped in the upstream Spring Data JPA release. TuxCare onboarded version 3.4.12 in September 2026, which already contained the complete defense implementation. No backport was needed.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-6652"
      },
      "impact_statement": "not_affected \u2014 CVE-2016-6652 (DATAJPA-965) SQL injection vulnerability is NOT present in spring-data-jpa 3.4.12. The fix was committed by Pivotal engineers (Christoph Strobl, Oliver Gierke) in September 2016 and shipped in the upstream Spring Data JPA release. TuxCare onboarded version 3.4.12 in September 2026, which already contained the complete defense implementation. No backport was needed."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-jpa@3.4.12-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-jpa@3.4.12-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T03:16:00.111949+00:00",
      "status_notes": "Vulnerability CVE-2019-3797 does not affect version 3.4.12-tuxcare.1 of org.springframework.data:spring-data-jpa. not_affected \u2014 CVE-2019-3797 is not present in Spring Data JPA 3.4.12. The vulnerability concerned insufficient escaping of SQL wildcard characters (_,%) in LIKE queries for derived query predicates (contains/startsWith/endsWith). The fix, which adds the EscapeCharacter class and automatic wildcard escaping, was introduced in upstream Spring Data JPA 2.2.0.M3 (March 2019) via commits DATAJPA-1519 and DATAJPA-...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3797"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-3797 is not present in Spring Data JPA 3.4.12. The vulnerability concerned insufficient escaping of SQL wildcard characters (_,%) in LIKE queries for derived query predicates (contains/startsWith/endsWith). The fix, which adds the EscapeCharacter class and automatic wildcard escaping, was introduced in upstream Spring Data JPA 2.2.0.M3 (March 2019) via commits DATAJPA-1519 and DATAJPA-..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-jpa@3.4.12-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-jpa@3.4.12-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T02:47:53.295233+00:00",
      "status_notes": "Vulnerability CVE-2019-3802 does not affect version 3.4.12-tuxcare.1 of org.springframework.data:spring-data-jpa. not_affected \u2014 CVE-2019-3802 affected Spring Data JPA versions up to 2.1.6, 2.0.14, and 1.11.20, allowing malicious SQL LIKE wildcards in ExampleMatcher queries to return more results than intended. The target version 3.4.12 contains the upstream fix (commits 075b4bad6 and d15f5efc5) authored by Jens Schauder at Pivotal/VMware. These fixes escape SQL LIKE wildcards (%, _) and the escape character itself in us...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3802"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-3802 affected Spring Data JPA versions up to 2.1.6, 2.0.14, and 1.11.20, allowing malicious SQL LIKE wildcards in ExampleMatcher queries to return more results than intended. The target version 3.4.12 contains the upstream fix (commits 075b4bad6 and d15f5efc5) authored by Jens Schauder at Pivotal/VMware. These fixes escape SQL LIKE wildcards (%, _) and the escape character itself in us..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-jpa@3.4.12-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-jpa@3.4.12-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-28T16:26:32.007200+00:00",
      "status_notes": "Vulnerability CVE-2026-47834 affects version 3.4.12-tuxcare.1 of org.springframework.data:spring-data-jpa.",
      "vulnerability": {
        "name": "CVE-2026-47834"
      },
      "action_statement": "Vulnerability CVE-2026-47834 affects version 3.4.12-tuxcare.1 of org.springframework.data:spring-data-jpa."
    }
  ]
}