{
  "@id": "urn:uuid:c91c36b7-76dc-47e2-8bf5-f09dce38a1ee",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 9,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T18:24:00.185895+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/mysql/mysql-connector-java@5.1.49-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/mysql/mysql-connector-java@5.1.49-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T17:29:41.554827+00:00",
      "status_notes": "Vulnerability CVE-2015-2575 does not affect version 5.1.49-tuxcare.1 of mysql:mysql-connector-java. not_affected \u2014 The target MySQL Connector/J version 5.1.49 is not affected by CVE-2015-2575 (SQL injection vulnerability). The vulnerability was fixed by Oracle in upstream version 5.1.35, and the target version (5.1.49) already contains this fix. The fix was shipped in the upstream release that TuxCare onboarded, not applied as a separate TuxCare backport.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-2575"
      },
      "impact_statement": "not_affected \u2014 The target MySQL Connector/J version 5.1.49 is not affected by CVE-2015-2575 (SQL injection vulnerability). The vulnerability was fixed by Oracle in upstream version 5.1.35, and the target version (5.1.49) already contains this fix. The fix was shipped in the upstream release that TuxCare onboarded, not applied as a separate TuxCare backport."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/mysql/mysql-connector-java@5.1.49-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/mysql/mysql-connector-java@5.1.49-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T18:24:00.185895+00:00",
      "status_notes": "Vulnerability CVE-2017-3523 does not affect version 5.1.49-tuxcare.1 of mysql:mysql-connector-java. Prechecker: The upstream fix is already in this version's source history (commit 6189e718). The upstream fix was released in 5.1.41, and version 5.1.49 is a later release of the same line. Advisories: GitHub GHSA-2xxh-f8r3-hvvr (fixed in 5.1.41), Snyk (fixed in 5.1.41).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-3523"
      },
      "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commit 6189e718). The upstream fix was released in 5.1.41, and version 5.1.49 is a later release of the same line. Advisories: GitHub GHSA-2xxh-f8r3-hvvr (fixed in 5.1.41), Snyk (fixed in 5.1.41)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/mysql/mysql-connector-java@5.1.49-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/mysql/mysql-connector-java@5.1.49-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T04:46:00.079487+00:00",
      "status_notes": "Vulnerability CVE-2017-3586 does not affect version 5.1.49-tuxcare.1 of mysql:mysql-connector-java. not_affected \u2014 CVE-2017-3586 is a SQL injection vulnerability in MySQL Connector/J's sessionVariables handling that allows attackers to execute arbitrary SQL commands. The target version 5.1.49 is NOT affected because the fix (combining all session variable assignments into a single SET statement) was already present in the upstream MySQL Connector/J 5.1.49 release, authored by Oracle engineer Filipe Silva. T...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-3586"
      },
      "impact_statement": "not_affected \u2014 CVE-2017-3586 is a SQL injection vulnerability in MySQL Connector/J's sessionVariables handling that allows attackers to execute arbitrary SQL commands. The target version 5.1.49 is NOT affected because the fix (combining all session variable assignments into a single SET statement) was already present in the upstream MySQL Connector/J 5.1.49 release, authored by Oracle engineer Filipe Silva. T..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/mysql/mysql-connector-java@5.1.49-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/mysql/mysql-connector-java@5.1.49-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T04:45:00.114756+00:00",
      "status_notes": "Vulnerability CVE-2017-3589 does not affect version 5.1.49-tuxcare.1 of mysql:mysql-connector-java. not_affected \u2014 CVE-2017-3589 affects MySQL Connector/J versions 5.1.41 and earlier. The target version 5.1.49 is not affected because the upstream fix (commit 6189e718 by Oracle) was already included in version 5.1.41. The fix prevents automatic deserialization of binary data by gating it behind the getAutoDeserialize() configuration check. TuxCare onboarded version 5.1.49 with this upstream fix already present.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-3589"
      },
      "impact_statement": "not_affected \u2014 CVE-2017-3589 affects MySQL Connector/J versions 5.1.41 and earlier. The target version 5.1.49 is not affected because the upstream fix (commit 6189e718 by Oracle) was already included in version 5.1.41. The fix prevents automatic deserialization of binary data by gating it behind the getAutoDeserialize() configuration check. TuxCare onboarded version 5.1.49 with this upstream fix already present."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/mysql/mysql-connector-java@5.1.49-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/mysql/mysql-connector-java@5.1.49-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T10:05:00.136501+00:00",
      "status_notes": "Vulnerability CVE-2018-3258 is a false positive for mysql:mysql-connector-java 5.1.49-tuxcare.1. The version is not vulnerable.",
      "vulnerability": {
        "name": "CVE-2018-3258"
      },
      "impact_statement": "The version is not vulnerable."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/mysql/mysql-connector-java@5.1.49-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/mysql/mysql-connector-java@5.1.49-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2019-2692 affects version 5.1.49-tuxcare.1 of mysql:mysql-connector-java.",
      "vulnerability": {
        "name": "CVE-2019-2692"
      },
      "action_statement": "Vulnerability CVE-2019-2692 affects version 5.1.49-tuxcare.1 of mysql:mysql-connector-java."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/mysql/mysql-connector-java@5.1.49-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/mysql/mysql-connector-java@5.1.49-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-2471 is fixed in version 5.1.49-tuxcare.1 of mysql:mysql-connector-java.",
      "vulnerability": {
        "name": "CVE-2021-2471"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/mysql/mysql-connector-java@5.1.49-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/mysql/mysql-connector-java@5.1.49-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-21363 affects version 5.1.49-tuxcare.1 of mysql:mysql-connector-java.",
      "vulnerability": {
        "name": "CVE-2022-21363"
      },
      "action_statement": "Vulnerability CVE-2022-21363 affects version 5.1.49-tuxcare.1 of mysql:mysql-connector-java."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/mysql/mysql-connector-java@5.1.49-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/mysql/mysql-connector-java@5.1.49-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-22102 affects version 5.1.49-tuxcare.1 of mysql:mysql-connector-java.",
      "vulnerability": {
        "name": "CVE-2023-22102"
      },
      "action_statement": "Vulnerability CVE-2023-22102 affects version 5.1.49-tuxcare.1 of mysql:mysql-connector-java."
    }
  ]
}