{
  "@id": "urn:uuid:cf515d01-aa50-4b06-8e13-d0e580ee33dc",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 8,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:02:00.202619+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.integration/spring-integration-core@6.3.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.integration/spring-integration-core@6.3.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:02:00.202619+00:00",
      "status_notes": "Vulnerability CVE-2020-5413 does not affect version 6.3.10-tuxcare.1 of org.springframework.integration:spring-integration-core. CVE-2020-5413 affects Spring Integration's Kryo Codec implementations, where Kryo configured with default options allows arbitrary class deserialization, enabling \"deserialization gadgets\" attacks. The vulnerability is mitigated by calling kryo.setRegistrationRequired(true) to enforce explicit class registration. The target repository (spring-integration 6.3.10-tuxcare.2) already contains this fix, which was shipped in the upstream release 6.3.10 authored by Artem Bilan (abilan@vmware.com). The fix is present at AbstractKryoCodec.java line 51 and was part of commit 6a02b5abe9, which is an ancestor of the first TuxCare onboarding commit b8c26da0a4. Therefore, the target is not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.3.0, < 4.3.23; >= 5.3.0, < 5.3.2; >= 5.1.0, < 5.1.12; >= 5.2.0, < 5.2.8), NVD (>= 4.3.0, <= 4.3.22; >= 5.1.0, <= 5.1.11; >= 5.2.0, <= 5.2.7; >= 5.3.0, <= 5.3.1), cve.org (>= 4.3, < 4.3.23.RELEASE; >= 5.1, < 5.1.12.RELEASE; >= 5.2, < 5.2.8.RELEASE; >= 5.3, < 5.3.2.RELEASE), Snyk (>= 4.3.0, < 4.3.23; >= 5.1.0, < 5.1.12; >= 5.2.0, < 5.2.8; >= 5.3.0, < 5.3.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5413"
      },
      "impact_statement": "CVE-2020-5413 affects Spring Integration's Kryo Codec implementations, where Kryo configured with default options allows arbitrary class deserialization, enabling \"deserialization gadgets\" attacks. The vulnerability is mitigated by calling kryo.setRegistrationRequired(true) to enforce explicit class registration. The target repository (spring-integration 6.3.10-tuxcare.2) already contains this fix, which was shipped in the upstream release 6.3.10 authored by Artem Bilan (abilan@vmware.com). The fix is present at AbstractKryoCodec.java line 51 and was part of commit 6a02b5abe9, which is an ancestor of the first TuxCare onboarding commit b8c26da0a4. Therefore, the target is not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.3.0, < 4.3.23; >= 5.3.0, < 5.3.2; >= 5.1.0, < 5.1.12; >= 5.2.0, < 5.2.8), NVD (>= 4.3.0, <= 4.3.22; >= 5.1.0, <= 5.1.11; >= 5.2.0, <= 5.2.7; >= 5.3.0, <= 5.3.1), cve.org (>= 4.3, < 4.3.23.RELEASE; >= 5.1, < 5.1.12.RELEASE; >= 5.2, < 5.2.8.RELEASE; >= 5.3, < 5.3.2.RELEASE), Snyk (>= 4.3.0, < 4.3.23; >= 5.1.0, < 5.1.12; >= 5.2.0, < 5.2.8; >= 5.3.0, < 5.3.2)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.integration/spring-integration-core@6.3.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.integration/spring-integration-core@6.3.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-14T09:56:42.405851+00:00",
      "status_notes": "Vulnerability CVE-2026-47856 affects version 6.3.10-tuxcare.1 of org.springframework.integration:spring-integration-core, and is fixed in 6.3.10-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-47856"
      },
      "action_statement": "Vulnerability CVE-2026-47856 affects version 6.3.10-tuxcare.1 of org.springframework.integration:spring-integration-core, and is fixed in 6.3.10-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.integration/spring-integration-core@6.3.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.integration/spring-integration-core@6.3.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-14T09:56:42.405851+00:00",
      "status_notes": "Vulnerability CVE-2026-59292 affects version 6.3.10-tuxcare.1 of org.springframework.integration:spring-integration-core, and is fixed in 6.3.10-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-59292"
      },
      "action_statement": "Vulnerability CVE-2026-59292 affects version 6.3.10-tuxcare.1 of org.springframework.integration:spring-integration-core, and is fixed in 6.3.10-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.integration/spring-integration-core@6.3.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.integration/spring-integration-core@6.3.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-14T09:56:42.405851+00:00",
      "status_notes": "Vulnerability CVE-2026-59322 affects version 6.3.10-tuxcare.1 of org.springframework.integration:spring-integration-core, and is fixed in 6.3.10-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-59322"
      },
      "action_statement": "Vulnerability CVE-2026-59322 affects version 6.3.10-tuxcare.1 of org.springframework.integration:spring-integration-core, and is fixed in 6.3.10-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.integration/spring-integration-core@6.3.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.integration/spring-integration-core@6.3.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-14T09:56:42.405851+00:00",
      "status_notes": "Vulnerability CVE-2026-59324 affects version 6.3.10-tuxcare.1 of org.springframework.integration:spring-integration-core, and is fixed in 6.3.10-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-59324"
      },
      "action_statement": "Vulnerability CVE-2026-59324 affects version 6.3.10-tuxcare.1 of org.springframework.integration:spring-integration-core, and is fixed in 6.3.10-tuxcare.2."
    }
  ]
}