{
  "@id": "urn:uuid:61c32e2e-2887-47af-8da1-37200c2ff659",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T12:52:41.784230+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.dataformat/jackson-dataformat-xml@2.15.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.dataformat/jackson-dataformat-xml@2.15.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T12:52:41.784230+00:00",
      "status_notes": "Vulnerability CVE-2016-3720 does not affect version 2.15.4-tuxcare.2 of com.fasterxml.jackson.dataformat:jackson-dataformat-xml. CVE-2016-3720 (XXE vulnerability) is not present in jackson-dataformat-xml 2.15.4-tuxcare.1. The fix that disables external entity processing (setting IS_SUPPORTING_EXTERNAL_ENTITIES to FALSE) is present in XmlFactory.java lines 125-127. This fix was authored by the upstream vendor (Tatu Saloranta) in April 2016 (commit f0f19a4c) and was already included in the upstream 2.15.4 release before TuxCare onboarded it. The vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.4), NVD (<= 2.7.3), Snyk (>= 2.0.0, < 2.7.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-3720"
      },
      "impact_statement": "CVE-2016-3720 (XXE vulnerability) is not present in jackson-dataformat-xml 2.15.4-tuxcare.1. The fix that disables external entity processing (setting IS_SUPPORTING_EXTERNAL_ENTITIES to FALSE) is present in XmlFactory.java lines 125-127. This fix was authored by the upstream vendor (Tatu Saloranta) in April 2016 (commit f0f19a4c) and was already included in the upstream 2.15.4 release before TuxCare onboarded it. The vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.4), NVD (<= 2.7.3), Snyk (>= 2.0.0, < 2.7.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.dataformat/jackson-dataformat-xml@2.15.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.dataformat/jackson-dataformat-xml@2.15.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T12:52:41.784230+00:00",
      "status_notes": "Vulnerability CVE-2016-7051 does not affect version 2.15.4-tuxcare.2 of com.fasterxml.jackson.dataformat:jackson-dataformat-xml. The target repository (jackson-dataformat-xml version 2.15.4-tuxcare.1) is NOT AFFECTED by CVE-2016-7051. The vulnerability (SSRF via DTD external entity processing) was fixed by the upstream vendor in version 2.7.8 (September 2016) via commit eeff2c312e9d4caa8c9f27b8f740c7529d00524a. The fix disables DTD processing by default by setting XMLInputFactory.SUPPORT_DTD to Boolean.FALSE. This upstream fix was already present in the version 2.15.4 release that TuxCare onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.8; >= 2.8.0, < 2.8.4), NVD (< 2.7.8; = 2.8.0; = 2.8.0-rc1; = 2.8.0-rc2; = 2.8.1; = 2.8.2; = 2.8.3), Snyk (>= 2.7.4, < 2.7.8; >= 2.8.0, <= 2.8.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-7051"
      },
      "impact_statement": "The target repository (jackson-dataformat-xml version 2.15.4-tuxcare.1) is NOT AFFECTED by CVE-2016-7051. The vulnerability (SSRF via DTD external entity processing) was fixed by the upstream vendor in version 2.7.8 (September 2016) via commit eeff2c312e9d4caa8c9f27b8f740c7529d00524a. The fix disables DTD processing by default by setting XMLInputFactory.SUPPORT_DTD to Boolean.FALSE. This upstream fix was already present in the version 2.15.4 release that TuxCare onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.8; >= 2.8.0, < 2.8.4), NVD (< 2.7.8; = 2.8.0; = 2.8.0-rc1; = 2.8.0-rc2; = 2.8.1; = 2.8.2; = 2.8.3), Snyk (>= 2.7.4, < 2.7.8; >= 2.8.0, <= 2.8.4)."
    }
  ]
}