{
  "@id": "urn:uuid:9d4eb058-4907-40ba-9963-c8083d130be1",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 8,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:03:00.104314+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.batch/spring-batch-core@4.2.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.batch/spring-batch-core@4.2.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:02:52.397356+00:00",
      "status_notes": "Vulnerability CVE-2019-3774 does not affect version 4.2.4.RELEASE-tuxcare.2 of org.springframework.batch:spring-batch-core. CVE-2019-3774 (XXE in Spring Batch XML processing) is NOT present in this target. The upstream fix that disables DTD processing and external entity resolution in XMLInputFactory is already present. The fix was authored by Mahmoud Ben Hassine (mbenhassine@pivotal.io) in January 2019 and shipped in Spring Batch 4.2.4.RELEASE, which TuxCare onboarded. The target uses StaxUtils.createXmlInputFactory() which sets SUPPORT_DTD=false and IS_SUPPORTING_EXTERNAL_ENTITIES=false, preventing XXE attacks. No vulnerable XML parsing code paths exist.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.10.RELEASE; >= 4.0.0.RELEASE, < 4.0.2.RELEASE; >= 4.1.0.RELEASE, < 4.1.1.RELEASE), NVD (<= 3.0.9; >= 4.0.0, <= 4.0.1; = 4.1.0), cve.org (>= 4.0, < 4.0.1.RELEASE; >= 4.1, < 4.1.0.RELEASE; >= 3.0, < 3.0.9.RELEASE), Snyk (>= 4.1.0.RELEASE, < 4.1.1.RELEASE; >= 4.0.0.RELEASE, < 4.0.2.RELEASE; >= 3.0.9.RELEASE, < 3.0.10.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3774"
      },
      "impact_statement": "CVE-2019-3774 (XXE in Spring Batch XML processing) is NOT present in this target. The upstream fix that disables DTD processing and external entity resolution in XMLInputFactory is already present. The fix was authored by Mahmoud Ben Hassine (mbenhassine@pivotal.io) in January 2019 and shipped in Spring Batch 4.2.4.RELEASE, which TuxCare onboarded. The target uses StaxUtils.createXmlInputFactory() which sets SUPPORT_DTD=false and IS_SUPPORTING_EXTERNAL_ENTITIES=false, preventing XXE attacks. No vulnerable XML parsing code paths exist.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.10.RELEASE; >= 4.0.0.RELEASE, < 4.0.2.RELEASE; >= 4.1.0.RELEASE, < 4.1.1.RELEASE), NVD (<= 3.0.9; >= 4.0.0, <= 4.0.1; = 4.1.0), cve.org (>= 4.0, < 4.0.1.RELEASE; >= 4.1, < 4.1.0.RELEASE; >= 3.0, < 3.0.9.RELEASE), Snyk (>= 4.1.0.RELEASE, < 4.1.1.RELEASE; >= 4.0.0.RELEASE, < 4.0.2.RELEASE; >= 3.0.9.RELEASE, < 3.0.10.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.batch/spring-batch-core@4.2.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.batch/spring-batch-core@4.2.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:03:00.104314+00:00",
      "status_notes": "Vulnerability CVE-2020-5411 does not affect version 4.2.4.RELEASE-tuxcare.2 of org.springframework.batch:spring-batch-core. The target repository (Spring Batch 4.2.4.RELEASE-tuxcare.2) is not affected by CVE-2020-5411. The upstream vendor fix was already present in Spring Batch 4.2.4.RELEASE before TuxCare onboarded it. The vulnerable pattern (unrestricted Jackson default typing via enableDefaultTyping()) has been replaced with a secure whitelist-based validation mechanism (TrustedTypeIdResolver) that prevents arbitrary deserialization gadgets. Fix commit 6d7d2927 by upstream author mbenhassine@vmware.com is an ancestor of the first TuxCare commit 228285f0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.2.3), NVD (>= 4.0.0, <= 4.0.4; >= 4.1.0, <= 4.1.4; >= 4.2.0, <= 4.2.2), cve.org (>= 4, < 4.2.3), Snyk (>= 4.0.0.RELEASE, < 4.2.3.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5411"
      },
      "impact_statement": "The target repository (Spring Batch 4.2.4.RELEASE-tuxcare.2) is not affected by CVE-2020-5411. The upstream vendor fix was already present in Spring Batch 4.2.4.RELEASE before TuxCare onboarded it. The vulnerable pattern (unrestricted Jackson default typing via enableDefaultTyping()) has been replaced with a secure whitelist-based validation mechanism (TrustedTypeIdResolver) that prevents arbitrary deserialization gadgets. Fix commit 6d7d2927 by upstream author mbenhassine@vmware.com is an ancestor of the first TuxCare commit 228285f0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.2.3), NVD (>= 4.0.0, <= 4.0.4; >= 4.1.0, <= 4.1.4; >= 4.2.0, <= 4.2.2), cve.org (>= 4, < 4.2.3), Snyk (>= 4.0.0.RELEASE, < 4.2.3.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.batch/spring-batch-core@4.2.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.batch/spring-batch-core@4.2.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T15:30:49.741847+00:00",
      "status_notes": "Vulnerability CVE-2026-47875 does not affect version 4.2.4.RELEASE-tuxcare.2 of org.springframework.batch:spring-batch-core. not_affected \u2014 Spring Batch 4.2.4.RELEASE is NOT affected by CVE-2026-47875. The vulnerability exists in version 5.x where the JobParameter API was redesigned to support arbitrary types via Class.forName(). Version 4.2.4 uses an older, type-safe enum-based API that only accepts four hardcoded parameter types (STRING, DATE, LONG, DOUBLE). The vulnerable code pattern - calling Class.forName() with attacker-cont...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-47875"
      },
      "impact_statement": "not_affected \u2014 Spring Batch 4.2.4.RELEASE is NOT affected by CVE-2026-47875. The vulnerability exists in version 5.x where the JobParameter API was redesigned to support arbitrary types via Class.forName(). Version 4.2.4 uses an older, type-safe enum-based API that only accepts four hardcoded parameter types (STRING, DATE, LONG, DOUBLE). The vulnerable code pattern - calling Class.forName() with attacker-cont..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.batch/spring-batch-core@4.2.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.batch/spring-batch-core@4.2.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-21T15:47:04.731299+00:00",
      "status_notes": "Vulnerability CVE-2026-47878 is fixed in version 4.2.4.RELEASE-tuxcare.2 of org.springframework.batch:spring-batch-core.",
      "vulnerability": {
        "name": "CVE-2026-47878"
      }
    }
  ]
}