{
  "@id": "urn:uuid:293abea9-bb8d-43eb-b84a-b52a622b058a",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 7,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T18:32:00.321693+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-jpa@3.5.13-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-jpa@3.5.13-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-02T18:32:00.321693+00:00",
      "status_notes": "Vulnerability CVE-2016-6652 does not affect version 3.5.13-tuxcare.4 of org.springframework.data:spring-data-jpa. not_affected \u2014 Target Spring Data JPA 3.5.13 is NOT AFFECTED by CVE-2016-6652. The fix for SQL injection via malicious Sort expressions was already included in the upstream release that TuxCare onboarded. The complete defense is present and operational: QueryUtils.checkSortExpression() validates all Sort properties using PUNCTATION_PATTERN (line 141) before appending them to ORDER BY clauses, rejecting any co...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-6652"
      },
      "impact_statement": "not_affected \u2014 Target Spring Data JPA 3.5.13 is NOT AFFECTED by CVE-2016-6652. The fix for SQL injection via malicious Sort expressions was already included in the upstream release that TuxCare onboarded. The complete defense is present and operational: QueryUtils.checkSortExpression() validates all Sort properties using PUNCTATION_PATTERN (line 141) before appending them to ORDER BY clauses, rejecting any co..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-jpa@3.5.13-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-jpa@3.5.13-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-02T03:13:02.428460+00:00",
      "status_notes": "Vulnerability CVE-2019-3797 does not affect version 3.5.13-tuxcare.4 of org.springframework.data:spring-data-jpa. not_affected \u2014 CVE-2019-3797 is not present in Spring Data JPA 3.5.13-tuxcare.4. The vulnerability affected derived queries with `startingWith`, `endingWith`, or `containing` predicates, allowing maliciously crafted parameters with SQL LIKE wildcards (`_`, `%`) to return more results than intended. The upstream fix (DATAJPA-1519) introduced the EscapeCharacter class and escaping logic throughout the query exe...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3797"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-3797 is not present in Spring Data JPA 3.5.13-tuxcare.4. The vulnerability affected derived queries with `startingWith`, `endingWith`, or `containing` predicates, allowing maliciously crafted parameters with SQL LIKE wildcards (`_`, `%`) to return more results than intended. The upstream fix (DATAJPA-1519) introduced the EscapeCharacter class and escaping logic throughout the query exe..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-jpa@3.5.13-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-jpa@3.5.13-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-02T02:37:37.853216+00:00",
      "status_notes": "Vulnerability CVE-2019-3802 does not affect version 3.5.13-tuxcare.4 of org.springframework.data:spring-data-jpa. not_affected \u2014 CVE-2019-3802 is NOT present in spring-data-jpa 3.5.13-tuxcare.4. The vulnerability (SQL wildcard injection in ExampleMatcher LIKE queries) was fixed by upstream Spring Data JPA in the 3.5.13 release that TuxCare subsequently onboarded. The fix properly escapes SQL LIKE wildcards (%, _) and the escape character (\\) in user-supplied values before constructing query predicates. Both components of...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3802"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-3802 is NOT present in spring-data-jpa 3.5.13-tuxcare.4. The vulnerability (SQL wildcard injection in ExampleMatcher LIKE queries) was fixed by upstream Spring Data JPA in the 3.5.13 release that TuxCare subsequently onboarded. The fix properly escapes SQL LIKE wildcards (%, _) and the escape character (\\) in user-supplied values before constructing query predicates. Both components of..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-jpa@3.5.13-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-jpa@3.5.13-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-22T15:28:38.629763+00:00",
      "status_notes": "Vulnerability CVE-2026-47834 is fixed in version 3.5.13-tuxcare.4 of org.springframework.data:spring-data-jpa.",
      "vulnerability": {
        "name": "CVE-2026-47834"
      }
    }
  ]
}