{
  "@id": "urn:uuid:75efe62d-98c0-444a-8468-8688e47c5c20",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 6,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:03:00.104314+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.integration/spring-integration-core@6.5.10-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.integration/spring-integration-core@6.5.10-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:03:00.104314+00:00",
      "status_notes": "Vulnerability CVE-2020-5413 does not affect version 6.5.10-tuxcare.2 of org.springframework.integration:spring-integration-core. CVE-2020-5413 is NOT present in spring-integration 6.5.10-tuxcare.5. The critical security fix (kryo.setRegistrationRequired(true)) that prevents arbitrary deserialization gadgets was already present in the upstream Spring Integration 6.5.10 release that TuxCare onboarded. The fix was authored by Artem Bilan (abilan@vmware.com) in commit 6a02b5abe9, which is an ancestor of the first TuxCare onboarding commit (779400246b). The target repository inherited this fix from upstream and is not vulnerable to deserialization attacks via unregistered Kryo classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.3.0, < 4.3.23; >= 5.3.0, < 5.3.2; >= 5.1.0, < 5.1.12; >= 5.2.0, < 5.2.8), NVD (>= 4.3.0, <= 4.3.22; >= 5.1.0, <= 5.1.11; >= 5.2.0, <= 5.2.7; >= 5.3.0, <= 5.3.1), cve.org (>= 4.3, < 4.3.23.RELEASE; >= 5.1, < 5.1.12.RELEASE; >= 5.2, < 5.2.8.RELEASE; >= 5.3, < 5.3.2.RELEASE), Snyk (>= 4.3.0, < 4.3.23; >= 5.1.0, < 5.1.12; >= 5.2.0, < 5.2.8; >= 5.3.0, < 5.3.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5413"
      },
      "impact_statement": "CVE-2020-5413 is NOT present in spring-integration 6.5.10-tuxcare.5. The critical security fix (kryo.setRegistrationRequired(true)) that prevents arbitrary deserialization gadgets was already present in the upstream Spring Integration 6.5.10 release that TuxCare onboarded. The fix was authored by Artem Bilan (abilan@vmware.com) in commit 6a02b5abe9, which is an ancestor of the first TuxCare onboarding commit (779400246b). The target repository inherited this fix from upstream and is not vulnerable to deserialization attacks via unregistered Kryo classes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.3.0, < 4.3.23; >= 5.3.0, < 5.3.2; >= 5.1.0, < 5.1.12; >= 5.2.0, < 5.2.8), NVD (>= 4.3.0, <= 4.3.22; >= 5.1.0, <= 5.1.11; >= 5.2.0, <= 5.2.7; >= 5.3.0, <= 5.3.1), cve.org (>= 4.3, < 4.3.23.RELEASE; >= 5.1, < 5.1.12.RELEASE; >= 5.2, < 5.2.8.RELEASE; >= 5.3, < 5.3.2.RELEASE), Snyk (>= 4.3.0, < 4.3.23; >= 5.1.0, < 5.1.12; >= 5.2.0, < 5.2.8; >= 5.3.0, < 5.3.2)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.integration/spring-integration-core@6.5.10-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.integration/spring-integration-core@6.5.10-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-13T15:52:00.097322+00:00",
      "status_notes": "Vulnerability CVE-2026-47856 is fixed in version 6.5.10-tuxcare.2 of org.springframework.integration:spring-integration-core.",
      "vulnerability": {
        "name": "CVE-2026-47856"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.integration/spring-integration-core@6.5.10-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.integration/spring-integration-core@6.5.10-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-13T15:51:10.626689+00:00",
      "status_notes": "Vulnerability CVE-2026-59292 is fixed in version 6.5.10-tuxcare.2 of org.springframework.integration:spring-integration-core.",
      "vulnerability": {
        "name": "CVE-2026-59292"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.integration/spring-integration-core@6.5.10-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.integration/spring-integration-core@6.5.10-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-13T15:51:10.626689+00:00",
      "status_notes": "Vulnerability CVE-2026-59322 is fixed in version 6.5.10-tuxcare.2 of org.springframework.integration:spring-integration-core.",
      "vulnerability": {
        "name": "CVE-2026-59322"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.integration/spring-integration-core@6.5.10-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.integration/spring-integration-core@6.5.10-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-13T15:51:10.626689+00:00",
      "status_notes": "Vulnerability CVE-2026-59324 is fixed in version 6.5.10-tuxcare.2 of org.springframework.integration:spring-integration-core.",
      "vulnerability": {
        "name": "CVE-2026-59324"
      }
    }
  ]
}