{
  "@id": "urn:uuid:f0c23cf7-4c6a-445b-9143-73b5af7e6458",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 8,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:03:00.104314+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.batch/spring-batch-core@4.3.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.batch/spring-batch-core@4.3.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:02:52.397356+00:00",
      "status_notes": "Vulnerability CVE-2019-3774 does not affect version 4.3.2-tuxcare.2 of org.springframework.batch:spring-batch-core. The target Spring Batch 4.3.2-tuxcare.2 is NOT affected by CVE-2019-3774 (XXE vulnerability). The XXE fix was already present in the upstream Spring Batch 4.3.2 release that TuxCare onboarded. The fix commit edfbdbb82 (Jan 2019) by upstream maintainer Mahmoud Ben Hassine added secure XML parsing defaults. The target further evolved this fix by using Spring Framework's StaxUtils.createDefensiveInputFactory() (commit 264243b73, Sep 2020), which provides equivalent XXE protection by setting SUPPORT_DTD=false and IS_SUPPORTING_EXTERNAL_ENTITIES=false, plus additional XML resolver protection. Both commits are authored by upstream (mbenhassine@pivotal.io / mbenhassine@vmware.com), not TuxCare, and both are ancestors of the first TuxCare onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.10.RELEASE; >= 4.0.0.RELEASE, < 4.0.2.RELEASE; >= 4.1.0.RELEASE, < 4.1.1.RELEASE), NVD (<= 3.0.9; >= 4.0.0, <= 4.0.1; = 4.1.0), cve.org (>= 4.0, < 4.0.1.RELEASE; >= 4.1, < 4.1.0.RELEASE; >= 3.0, < 3.0.9.RELEASE), Snyk (>= 4.1.0.RELEASE, < 4.1.1.RELEASE; >= 4.0.0.RELEASE, < 4.0.2.RELEASE; >= 3.0.9.RELEASE, < 3.0.10.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3774"
      },
      "impact_statement": "The target Spring Batch 4.3.2-tuxcare.2 is NOT affected by CVE-2019-3774 (XXE vulnerability). The XXE fix was already present in the upstream Spring Batch 4.3.2 release that TuxCare onboarded. The fix commit edfbdbb82 (Jan 2019) by upstream maintainer Mahmoud Ben Hassine added secure XML parsing defaults. The target further evolved this fix by using Spring Framework's StaxUtils.createDefensiveInputFactory() (commit 264243b73, Sep 2020), which provides equivalent XXE protection by setting SUPPORT_DTD=false and IS_SUPPORTING_EXTERNAL_ENTITIES=false, plus additional XML resolver protection. Both commits are authored by upstream (mbenhassine@pivotal.io / mbenhassine@vmware.com), not TuxCare, and both are ancestors of the first TuxCare onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.10.RELEASE; >= 4.0.0.RELEASE, < 4.0.2.RELEASE; >= 4.1.0.RELEASE, < 4.1.1.RELEASE), NVD (<= 3.0.9; >= 4.0.0, <= 4.0.1; = 4.1.0), cve.org (>= 4.0, < 4.0.1.RELEASE; >= 4.1, < 4.1.0.RELEASE; >= 3.0, < 3.0.9.RELEASE), Snyk (>= 4.1.0.RELEASE, < 4.1.1.RELEASE; >= 4.0.0.RELEASE, < 4.0.2.RELEASE; >= 3.0.9.RELEASE, < 3.0.10.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.batch/spring-batch-core@4.3.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.batch/spring-batch-core@4.3.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:03:00.104314+00:00",
      "status_notes": "Vulnerability CVE-2020-5411 does not affect version 4.3.2-tuxcare.2 of org.springframework.batch:spring-batch-core. The target repository (Spring Batch 4.3.2-tuxcare.2) is NOT affected by CVE-2020-5411. The vulnerability pattern (unrestricted Jackson default typing via enableDefaultTyping()) was removed by upstream Spring Batch in commit 9a79b457 dated June 10, 2020, which replaced it with a TrustedTypeIdResolver that maintains a whitelist of safe classes and validates all deserialization attempts. This fix was already present in the upstream Spring Batch 4.3.2 release when TuxCare onboarded it (commit 33a630f1a, \"Onboard version 4.3.2\"). The vulnerable code pattern does not exist in HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.2.3), NVD (>= 4.0.0, <= 4.0.4; >= 4.1.0, <= 4.1.4; >= 4.2.0, <= 4.2.2), cve.org (>= 4, < 4.2.3), Snyk (>= 4.0.0.RELEASE, < 4.2.3.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5411"
      },
      "impact_statement": "The target repository (Spring Batch 4.3.2-tuxcare.2) is NOT affected by CVE-2020-5411. The vulnerability pattern (unrestricted Jackson default typing via enableDefaultTyping()) was removed by upstream Spring Batch in commit 9a79b457 dated June 10, 2020, which replaced it with a TrustedTypeIdResolver that maintains a whitelist of safe classes and validates all deserialization attempts. This fix was already present in the upstream Spring Batch 4.3.2 release when TuxCare onboarded it (commit 33a630f1a, \"Onboard version 4.3.2\"). The vulnerable code pattern does not exist in HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.2.3), NVD (>= 4.0.0, <= 4.0.4; >= 4.1.0, <= 4.1.4; >= 4.2.0, <= 4.2.2), cve.org (>= 4, < 4.2.3), Snyk (>= 4.0.0.RELEASE, < 4.2.3.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.batch/spring-batch-core@4.3.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.batch/spring-batch-core@4.3.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T15:30:49.741847+00:00",
      "status_notes": "Vulnerability CVE-2026-47875 does not affect version 4.3.2-tuxcare.2 of org.springframework.batch:spring-batch-core. not_affected \u2014 Spring Batch 4.3.2 is not affected by CVE-2026-47875. The vulnerability exists only in Spring Batch 5.x versions where JobParameterDeserializer uses Class.forName() to load arbitrary classes. Version 4.3.2 uses an enum-based type restriction (ParameterType.valueOf) that only allows STRING, DATE, LONG, or DOUBLE types, preventing arbitrary class loading. The vulnerable code pattern simply does n...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-47875"
      },
      "impact_statement": "not_affected \u2014 Spring Batch 4.3.2 is not affected by CVE-2026-47875. The vulnerability exists only in Spring Batch 5.x versions where JobParameterDeserializer uses Class.forName() to load arbitrary classes. Version 4.3.2 uses an enum-based type restriction (ParameterType.valueOf) that only allows STRING, DATE, LONG, or DOUBLE types, preventing arbitrary class loading. The vulnerable code pattern simply does n..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.batch/spring-batch-core@4.3.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.batch/spring-batch-core@4.3.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-21T15:46:27.686689+00:00",
      "status_notes": "Vulnerability CVE-2026-47878 is fixed in version 4.3.2-tuxcare.2 of org.springframework.batch:spring-batch-core.",
      "vulnerability": {
        "name": "CVE-2026-47878"
      }
    }
  ]
}