{
  "@id": "urn:uuid:b2374f33-0850-4175-aacd-24d3dc41ae7b",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:04:11.456857+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.ws/spring-xml@4.0.8-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.ws/spring-xml@4.0.8-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:04:11.456857+00:00",
      "status_notes": "Vulnerability CVE-2019-3773 does not affect version 4.0.8-tuxcare.3 of org.springframework.ws:spring-xml. CVE-2019-3773 (XXE vulnerability) is NOT present in spring-ws 4.0.8-tuxcare.3. The upstream vendor fix (commit 1f05307d by Greg Turnquist) was already included in the upstream release 4.0.8 that TuxCare onboarded. The fix introduces secure XML parser utility classes (DocumentBuilderFactoryUtils, XMLInputFactoryUtils, TransformerFactoryUtils) that disable external entity processing, and all direct unsafe API calls have been replaced with these secure utilities throughout the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.4.4; >= 3.0.0, < 3.0.6; < 2.4.4; >= 3.0.0, < 3.0.6), Snyk (< 2.4.4.RELEASE; >= 3.0.0.RELEASE, < 3.0.6.RELEASE; < 2.4.4.RELEASE; >= 3.0.0.RELEASE, < 3.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3773"
      },
      "impact_statement": "CVE-2019-3773 (XXE vulnerability) is NOT present in spring-ws 4.0.8-tuxcare.3. The upstream vendor fix (commit 1f05307d by Greg Turnquist) was already included in the upstream release 4.0.8 that TuxCare onboarded. The fix introduces secure XML parser utility classes (DocumentBuilderFactoryUtils, XMLInputFactoryUtils, TransformerFactoryUtils) that disable external entity processing, and all direct unsafe API calls have been replaced with these secure utilities throughout the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.4.4; >= 3.0.0, < 3.0.6; < 2.4.4; >= 3.0.0, < 3.0.6), Snyk (< 2.4.4.RELEASE; >= 3.0.0.RELEASE, < 3.0.6.RELEASE; < 2.4.4.RELEASE; >= 3.0.0.RELEASE, < 3.0.6.RELEASE)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.ws/spring-xml@4.0.8-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.ws/spring-xml@4.0.8-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-27T14:54:42.987953+00:00",
      "status_notes": "Vulnerability CVE-2026-40998 is fixed in version 4.0.8-tuxcare.3 of org.springframework.ws:spring-xml.",
      "vulnerability": {
        "name": "CVE-2026-40998"
      }
    }
  ]
}