{
  "@id": "urn:uuid:5bb6a51e-38db-4302-8b0a-5b368c000a4e",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 6,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:03:00.104314+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.integration/spring-integration-core@5.4.6-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.integration/spring-integration-core@5.4.6-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:03:00.104314+00:00",
      "status_notes": "Vulnerability CVE-2020-5413 does not affect version 5.4.6-tuxcare.1 of org.springframework.integration:spring-integration-core. The target repository (spring-integration 5.4.6) is not affected by CVE-2020-5413. The security fix that adds `kryo.setRegistrationRequired(true)` to prevent arbitrary class deserialization via Kryo was already present in the upstream release 5.4.6 that TuxCare onboarded. The fix commit 6a02b5abe9 was authored by upstream developer Artem Bilan (abilan@vmware.com) on July 22, 2020, and is an ancestor of the first TuxCare onboarding commit 76a7654b3c. All Kryo codec deserialization paths (AbstractKryoCodec, PojoCodec, MessageCodec) inherit this protection, blocking deserialization of unregistered classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.3.0, < 4.3.23; >= 5.3.0, < 5.3.2; >= 5.1.0, < 5.1.12; >= 5.2.0, < 5.2.8), NVD (>= 4.3.0, <= 4.3.22; >= 5.1.0, <= 5.1.11; >= 5.2.0, <= 5.2.7; >= 5.3.0, <= 5.3.1), cve.org (>= 4.3, < 4.3.23.RELEASE; >= 5.1, < 5.1.12.RELEASE; >= 5.2, < 5.2.8.RELEASE; >= 5.3, < 5.3.2.RELEASE), Snyk (>= 4.3.0, < 4.3.23; >= 5.1.0, < 5.1.12; >= 5.2.0, < 5.2.8; >= 5.3.0, < 5.3.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5413"
      },
      "impact_statement": "The target repository (spring-integration 5.4.6) is not affected by CVE-2020-5413. The security fix that adds `kryo.setRegistrationRequired(true)` to prevent arbitrary class deserialization via Kryo was already present in the upstream release 5.4.6 that TuxCare onboarded. The fix commit 6a02b5abe9 was authored by upstream developer Artem Bilan (abilan@vmware.com) on July 22, 2020, and is an ancestor of the first TuxCare onboarding commit 76a7654b3c. All Kryo codec deserialization paths (AbstractKryoCodec, PojoCodec, MessageCodec) inherit this protection, blocking deserialization of unregistered classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.3.0, < 4.3.23; >= 5.3.0, < 5.3.2; >= 5.1.0, < 5.1.12; >= 5.2.0, < 5.2.8), NVD (>= 4.3.0, <= 4.3.22; >= 5.1.0, <= 5.1.11; >= 5.2.0, <= 5.2.7; >= 5.3.0, <= 5.3.1), cve.org (>= 4.3, < 4.3.23.RELEASE; >= 5.1, < 5.1.12.RELEASE; >= 5.2, < 5.2.8.RELEASE; >= 5.3, < 5.3.2.RELEASE), Snyk (>= 4.3.0, < 4.3.23; >= 5.1.0, < 5.1.12; >= 5.2.0, < 5.2.8; >= 5.3.0, < 5.3.2)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.integration/spring-integration-core@5.4.6-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.integration/spring-integration-core@5.4.6-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T17:44:00.122064+00:00",
      "status_notes": "Vulnerability CVE-2026-47856 is fixed in version 5.4.6-tuxcare.1 of org.springframework.integration:spring-integration-core.",
      "vulnerability": {
        "name": "CVE-2026-47856"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.integration/spring-integration-core@5.4.6-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.integration/spring-integration-core@5.4.6-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T17:44:00.122064+00:00",
      "status_notes": "Vulnerability CVE-2026-59292 is fixed in version 5.4.6-tuxcare.1 of org.springframework.integration:spring-integration-core.",
      "vulnerability": {
        "name": "CVE-2026-59292"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.integration/spring-integration-core@5.4.6-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.integration/spring-integration-core@5.4.6-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T17:44:00.122064+00:00",
      "status_notes": "Vulnerability CVE-2026-59322 is fixed in version 5.4.6-tuxcare.1 of org.springframework.integration:spring-integration-core.",
      "vulnerability": {
        "name": "CVE-2026-59322"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.integration/spring-integration-core@5.4.6-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.integration/spring-integration-core@5.4.6-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T17:44:00.122064+00:00",
      "status_notes": "Vulnerability CVE-2026-59324 is fixed in version 5.4.6-tuxcare.1 of org.springframework.integration:spring-integration-core.",
      "vulnerability": {
        "name": "CVE-2026-59324"
      }
    }
  ]
}