{
  "@id": "urn:uuid:ea34dc4e-e625-44df-9599-37c113bc8d40",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 7,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T19:53:56.253955+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.postgresql/postgresql@42.2.16-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.postgresql/postgresql@42.2.16-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T19:52:00.140459+00:00",
      "status_notes": "Vulnerability CVE-2012-1618 does not affect version 42.2.16-tuxcare.1 of org.postgresql:postgresql. not_affected \u2014 Target version 42.2.16 is not affected by CVE-2012-1618. The vulnerability was fixed in JDBC driver version 8.2 (released 2006-12-01) by upstream author Kris Jurka in commit 6237c152. The fix introduced proper parameter escaping in Utils.escapeLiteral() that correctly handles both standard_conforming_strings modes. This upstream fix was part of the base release that TuxCare later onboarded for ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2012-1618"
      },
      "impact_statement": "not_affected \u2014 Target version 42.2.16 is not affected by CVE-2012-1618. The vulnerability was fixed in JDBC driver version 8.2 (released 2006-12-01) by upstream author Kris Jurka in commit 6237c152. The fix introduced proper parameter escaping in Utils.escapeLiteral() that correctly handles both standard_conforming_strings modes. This upstream fix was part of the base release that TuxCare later onboarded for ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.postgresql/postgresql@42.2.16-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.postgresql/postgresql@42.2.16-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:08:14.959299+00:00",
      "status_notes": "Vulnerability CVE-2020-13692 does not affect version 42.2.16-tuxcare.1 of org.postgresql:postgresql. The target repository (pgjdbc 42.2.16 at SHA ecfbbd87) is NOT affected by CVE-2020-13692 (XXE vulnerability). The complete fix authored by Sehrope Sarkuni (sehrope@jackdb.com) in upstream commit 14b62aca was already present in the upstream release when TuxCare onboarded this version. All XML processing uses a secure factory pattern that disables external entity processing, DTD processing, and implements OWASP-recommended protections by default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.1212.jre6, < 42.2.13), NVD (< 42.2.13), Snyk (< 42.2.13).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-13692"
      },
      "impact_statement": "The target repository (pgjdbc 42.2.16 at SHA ecfbbd87) is NOT affected by CVE-2020-13692 (XXE vulnerability). The complete fix authored by Sehrope Sarkuni (sehrope@jackdb.com) in upstream commit 14b62aca was already present in the upstream release when TuxCare onboarded this version. All XML processing uses a secure factory pattern that disables external entity processing, DTD processing, and implements OWASP-recommended protections by default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.4.1212.jre6, < 42.2.13), NVD (< 42.2.13), Snyk (< 42.2.13)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.postgresql/postgresql@42.2.16-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.postgresql/postgresql@42.2.16-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-21724 is fixed in version 42.2.16-tuxcare.1 of org.postgresql:postgresql.",
      "vulnerability": {
        "name": "CVE-2022-21724"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.postgresql/postgresql@42.2.16-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.postgresql/postgresql@42.2.16-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-26520 is fixed in version 42.2.16-tuxcare.1 of org.postgresql:postgresql.",
      "vulnerability": {
        "name": "CVE-2022-26520"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.postgresql/postgresql@42.2.16-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.postgresql/postgresql@42.2.16-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-31197 affects version 42.2.16-tuxcare.1 of org.postgresql:postgresql, and is fixed in 42.2.16-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2022-31197"
      },
      "action_statement": "Vulnerability CVE-2022-31197 affects version 42.2.16-tuxcare.1 of org.postgresql:postgresql, and is fixed in 42.2.16-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.postgresql/postgresql@42.2.16-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.postgresql/postgresql@42.2.16-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-41946 affects version 42.2.16-tuxcare.1 of org.postgresql:postgresql, and is fixed in 42.2.16-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2022-41946"
      },
      "action_statement": "Vulnerability CVE-2022-41946 affects version 42.2.16-tuxcare.1 of org.postgresql:postgresql, and is fixed in 42.2.16-tuxcare.2."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.postgresql/postgresql@42.2.16-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.postgresql/postgresql@42.2.16-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-1597 is fixed in version 42.2.16-tuxcare.1 of org.postgresql:postgresql.",
      "vulnerability": {
        "name": "CVE-2024-1597"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.postgresql/postgresql@42.2.16-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.postgresql/postgresql@42.2.16-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T19:53:56.253955+00:00",
      "status_notes": "Vulnerability CVE-2025-49146 does not affect version 42.2.16-tuxcare.1 of org.postgresql:postgresql. not_affected \u2014 Version 42.2.16 is NOT AFFECTED by CVE-2025-49146. The vulnerability describes incorrect behavior when channel binding is configured as 'required', but this version lacks the channel binding configuration feature entirely. No 'channelBinding' property exists in PGProperty.java, and ScramAuthenticator hardcodes channel binding to NO (line 76). Since users cannot configure channel binding to 'req...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-49146"
      },
      "impact_statement": "not_affected \u2014 Version 42.2.16 is NOT AFFECTED by CVE-2025-49146. The vulnerability describes incorrect behavior when channel binding is configured as 'required', but this version lacks the channel binding configuration feature entirely. No 'channelBinding' property exists in PGProperty.java, and ScramAuthenticator hardcodes channel binding to NO (line 76). Since users cannot configure channel binding to 'req..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.postgresql/postgresql@42.2.16-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.postgresql/postgresql@42.2.16-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42198 affects version 42.2.16-tuxcare.1 of org.postgresql:postgresql.",
      "vulnerability": {
        "name": "CVE-2026-42198"
      },
      "action_statement": "Vulnerability CVE-2026-42198 affects version 42.2.16-tuxcare.1 of org.postgresql:postgresql."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.postgresql/postgresql@42.2.16-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.postgresql/postgresql@42.2.16-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T00:36:14.768306+00:00",
      "status_notes": "Vulnerability CVE-2026-54291 affects version 42.2.16-tuxcare.1 of org.postgresql:postgresql.",
      "vulnerability": {
        "name": "CVE-2026-54291"
      },
      "action_statement": "Vulnerability CVE-2026-54291 affects version 42.2.16-tuxcare.1 of org.postgresql:postgresql."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.postgresql/postgresql@42.2.16-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.postgresql/postgresql@42.2.16-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-673j-qm5f-xpv8 affects version 42.2.16-tuxcare.1 of org.postgresql:postgresql.",
      "vulnerability": {
        "name": "GHSA-673j-qm5f-xpv8"
      },
      "action_statement": "Vulnerability GHSA-673j-qm5f-xpv8 affects version 42.2.16-tuxcare.1 of org.postgresql:postgresql."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.postgresql/postgresql@42.2.16-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.postgresql/postgresql@42.2.16-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T14:02:30.472061+00:00",
      "status_notes": "Vulnerability GHSA-xfg6-62px-cxc2 is a false positive for org.postgresql:postgresql 42.2.16-tuxcare.1.",
      "vulnerability": {
        "name": "GHSA-xfg6-62px-cxc2"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}