{
  "@id": "urn:uuid:c58da109-30ec-46ba-bfee-38f1f37598eb",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-05T07:14:00.076714+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.ws/spring-xml@3.1.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.ws/spring-xml@3.1.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T07:13:22.852560+00:00",
      "status_notes": "Vulnerability CVE-2019-3773 does not affect version 3.1.5-tuxcare.3 of org.springframework.ws:spring-xml. CVE-2019-3773 (XXE vulnerability in Spring Web Services) is NOT present in spring-ws 3.1.5-tuxcare.2. The upstream fix (commit 1f05307d by Greg Turnquist) that introduces secure XML factory utility classes (DocumentBuilderFactoryUtils, XMLInputFactoryUtils, TransformerFactoryUtils) was already present in the upstream 3.1.5 release that TuxCare onboarded. All production code uses these secure utilities instead of direct factory instantiation. No vulnerable patterns remain. The fix disables external entity resolution, DTD processing, and external schema/stylesheet access comprehensively across DocumentBuilderFactory, XMLInputFactory, and TransformerFactory instances.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.4.4; >= 3.0.0, < 3.0.6; < 2.4.4; >= 3.0.0, < 3.0.6), Snyk (< 2.4.4.RELEASE; >= 3.0.0.RELEASE, < 3.0.6.RELEASE; < 2.4.4.RELEASE; >= 3.0.0.RELEASE, < 3.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3773"
      },
      "impact_statement": "CVE-2019-3773 (XXE vulnerability in Spring Web Services) is NOT present in spring-ws 3.1.5-tuxcare.2. The upstream fix (commit 1f05307d by Greg Turnquist) that introduces secure XML factory utility classes (DocumentBuilderFactoryUtils, XMLInputFactoryUtils, TransformerFactoryUtils) was already present in the upstream 3.1.5 release that TuxCare onboarded. All production code uses these secure utilities instead of direct factory instantiation. No vulnerable patterns remain. The fix disables external entity resolution, DTD processing, and external schema/stylesheet access comprehensively across DocumentBuilderFactory, XMLInputFactory, and TransformerFactory instances.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.4.4; >= 3.0.0, < 3.0.6; < 2.4.4; >= 3.0.0, < 3.0.6), Snyk (< 2.4.4.RELEASE; >= 3.0.0.RELEASE, < 3.0.6.RELEASE; < 2.4.4.RELEASE; >= 3.0.0.RELEASE, < 3.0.6.RELEASE)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.ws/spring-xml@3.1.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.ws/spring-xml@3.1.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T07:14:00.076714+00:00",
      "status_notes": "Vulnerability CVE-2026-40998 is fixed in version 3.1.5-tuxcare.3 of org.springframework.ws:spring-xml.",
      "vulnerability": {
        "name": "CVE-2026-40998"
      }
    }
  ]
}