{
  "@id": "urn:uuid:fb3bd4c5-db33-441f-a06f-01f289058aa6",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 6,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T05:05:00.060068+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-rest-core@4.3.12-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-rest-core@4.3.12-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-01T20:45:12.913197+00:00",
      "status_notes": "Vulnerability CVE-2017-8046 affects version 4.3.12-tuxcare.3 of org.springframework.data:spring-data-rest-core.",
      "vulnerability": {
        "name": "CVE-2017-8046"
      },
      "action_statement": "Vulnerability CVE-2017-8046 affects version 4.3.12-tuxcare.3 of org.springframework.data:spring-data-rest-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-rest-core@4.3.12-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-rest-core@4.3.12-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T05:05:00.060068+00:00",
      "status_notes": "Vulnerability CVE-2021-22047 does not affect version 4.3.12-tuxcare.3 of org.springframework.data:spring-data-rest-core. not_affected \u2014 The target repository (Spring Data REST 4.3.12-tuxcare.4) is not affected by CVE-2021-22047. The vulnerability pattern is not present because the fix was already included in the upstream 4.3.12 release that TuxCare onboarded. The fix commit (46dc6e03f) by Oliver Drotbohm adds validation in BasePathAwareHandlerMapping.isHandler() to reject Spring Data REST controllers with class-level @RequestMa...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22047"
      },
      "impact_statement": "not_affected \u2014 The target repository (Spring Data REST 4.3.12-tuxcare.4) is not affected by CVE-2021-22047. The vulnerability pattern is not present because the fix was already included in the upstream 4.3.12 release that TuxCare onboarded. The fix commit (46dc6e03f) by Oliver Drotbohm adds validation in BasePathAwareHandlerMapping.isHandler() to reject Spring Data REST controllers with class-level @RequestMa..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-rest-core@4.3.12-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-rest-core@4.3.12-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T22:22:47.785227+00:00",
      "status_notes": "Vulnerability CVE-2022-31679 does not affect version 4.3.12-tuxcare.3 of org.springframework.data:spring-data-rest-core. not_affected \u2014 The target Spring Data REST 4.3.12 is not affected by CVE-2022-31679. The vulnerability was fixed in the upstream release before TuxCare onboarded version 4.3.12. The fix introduces BindContext validation that checks Jackson annotations (@JsonIgnore, @JsonIgnoreProperties) before allowing JSON Patch operations to access entity properties. All security components (BindContext, JsonPointerMapping...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-31679"
      },
      "impact_statement": "not_affected \u2014 The target Spring Data REST 4.3.12 is not affected by CVE-2022-31679. The vulnerability was fixed in the upstream release before TuxCare onboarded version 4.3.12. The fix introduces BindContext validation that checks Jackson annotations (@JsonIgnore, @JsonIgnoreProperties) before allowing JSON Patch operations to access entity properties. All security components (BindContext, JsonPointerMapping..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-rest-core@4.3.12-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-rest-core@4.3.12-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-19T17:03:00.162372+00:00",
      "status_notes": "Vulnerability CVE-2026-41728 affects version 4.3.12-tuxcare.3 of org.springframework.data:spring-data-rest-core.",
      "vulnerability": {
        "name": "CVE-2026-41728"
      },
      "action_statement": "Vulnerability CVE-2026-41728 affects version 4.3.12-tuxcare.3 of org.springframework.data:spring-data-rest-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-rest-core@4.3.12-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-rest-core@4.3.12-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-19T17:03:00.162372+00:00",
      "status_notes": "Vulnerability CVE-2026-41729 is fixed in version 4.3.12-tuxcare.3 of org.springframework.data:spring-data-rest-core.",
      "vulnerability": {
        "name": "CVE-2026-41729"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-rest-core@4.3.12-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-rest-core@4.3.12-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-19T17:03:00.162372+00:00",
      "status_notes": "Vulnerability CVE-2026-41730 is fixed in version 4.3.12-tuxcare.3 of org.springframework.data:spring-data-rest-core.",
      "vulnerability": {
        "name": "CVE-2026-41730"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-rest-core@4.3.12-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-rest-core@4.3.12-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-19T17:03:00.162372+00:00",
      "status_notes": "Vulnerability CVE-2026-41837 is fixed in version 4.3.12-tuxcare.3 of org.springframework.data:spring-data-rest-core.",
      "vulnerability": {
        "name": "CVE-2026-41837"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-rest-core@4.3.12-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-rest-core@4.3.12-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-19T17:03:00.162372+00:00",
      "status_notes": "Vulnerability CVE-2026-47849 is fixed in version 4.3.12-tuxcare.3 of org.springframework.data:spring-data-rest-core.",
      "vulnerability": {
        "name": "CVE-2026-47849"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-rest-core@4.3.12-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-rest-core@4.3.12-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-19T17:03:00.162372+00:00",
      "status_notes": "Vulnerability CVE-2026-47850 is fixed in version 4.3.12-tuxcare.3 of org.springframework.data:spring-data-rest-core.",
      "vulnerability": {
        "name": "CVE-2026-47850"
      }
    }
  ]
}