{
  "@id": "urn:uuid:d474d3b6-7f55-426d-a3c4-a9e697f671ec",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 10,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:03:00.104314+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.batch/spring-batch-core@4.3.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.batch/spring-batch-core@4.3.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:00:45.012229+00:00",
      "status_notes": "Vulnerability CVE-2019-3774 does not affect version 4.3.3-tuxcare.1 of org.springframework.batch:spring-batch-core. CVE-2019-3774 (XXE in Spring Batch) is NOT present in this target. The vulnerability was fixed by upstream Spring maintainer Mahmoud Ben Hassine in commit edfbdbb82 (Jan 11, 2019) which added XXE protections to XMLInputFactory (SUPPORT_DTD=false, IS_SUPPORTING_EXTERNAL_ENTITIES=false). This fix was already present in the upstream Spring Batch 4.3.3 release that TuxCare onboarded. The current code uses Spring Framework's StaxUtils.createDefensiveInputFactory() which provides equivalent XXE protection. The testDtdXml() test confirms that external entities are correctly rejected. No vulnerable XML parsing paths exist in the production code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.10.RELEASE; >= 4.0.0.RELEASE, < 4.0.2.RELEASE; >= 4.1.0.RELEASE, < 4.1.1.RELEASE), NVD (<= 3.0.9; >= 4.0.0, <= 4.0.1; = 4.1.0), cve.org (>= 4.0, < 4.0.1.RELEASE; >= 4.1, < 4.1.0.RELEASE; >= 3.0, < 3.0.9.RELEASE), Snyk (>= 4.1.0.RELEASE, < 4.1.1.RELEASE; >= 4.0.0.RELEASE, < 4.0.2.RELEASE; >= 3.0.9.RELEASE, < 3.0.10.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3774"
      },
      "impact_statement": "CVE-2019-3774 (XXE in Spring Batch) is NOT present in this target. The vulnerability was fixed by upstream Spring maintainer Mahmoud Ben Hassine in commit edfbdbb82 (Jan 11, 2019) which added XXE protections to XMLInputFactory (SUPPORT_DTD=false, IS_SUPPORTING_EXTERNAL_ENTITIES=false). This fix was already present in the upstream Spring Batch 4.3.3 release that TuxCare onboarded. The current code uses Spring Framework's StaxUtils.createDefensiveInputFactory() which provides equivalent XXE protection. The testDtdXml() test confirms that external entities are correctly rejected. No vulnerable XML parsing paths exist in the production code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.10.RELEASE; >= 4.0.0.RELEASE, < 4.0.2.RELEASE; >= 4.1.0.RELEASE, < 4.1.1.RELEASE), NVD (<= 3.0.9; >= 4.0.0, <= 4.0.1; = 4.1.0), cve.org (>= 4.0, < 4.0.1.RELEASE; >= 4.1, < 4.1.0.RELEASE; >= 3.0, < 3.0.9.RELEASE), Snyk (>= 4.1.0.RELEASE, < 4.1.1.RELEASE; >= 4.0.0.RELEASE, < 4.0.2.RELEASE; >= 3.0.9.RELEASE, < 3.0.10.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.batch/spring-batch-core@4.3.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.batch/spring-batch-core@4.3.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:03:00.104314+00:00",
      "status_notes": "Vulnerability CVE-2020-5411 does not affect version 4.3.3-tuxcare.1 of org.springframework.batch:spring-batch-core. The target Spring Batch 4.3.3 is not affected by CVE-2020-5411. The vulnerability (unrestricted Jackson deserialization via enableDefaultTyping()) was fixed in the upstream Spring Batch release that TuxCare onboarded. The fix commit (9a79b4572) by Mahmoud Ben Hassine (mbenhassine@vmware.com) replaced unrestricted default typing with a TrustedTypeIdResolver that validates class names against a whitelist before deserialization, blocking arbitrary code execution through deserialization gadgets.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.2.3), NVD (>= 4.0.0, <= 4.0.4; >= 4.1.0, <= 4.1.4; >= 4.2.0, <= 4.2.2), cve.org (>= 4, < 4.2.3), Snyk (>= 4.0.0.RELEASE, < 4.2.3.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5411"
      },
      "impact_statement": "The target Spring Batch 4.3.3 is not affected by CVE-2020-5411. The vulnerability (unrestricted Jackson deserialization via enableDefaultTyping()) was fixed in the upstream Spring Batch release that TuxCare onboarded. The fix commit (9a79b4572) by Mahmoud Ben Hassine (mbenhassine@vmware.com) replaced unrestricted default typing with a TrustedTypeIdResolver that validates class names against a whitelist before deserialization, blocking arbitrary code execution through deserialization gadgets.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.2.3), NVD (>= 4.0.0, <= 4.0.4; >= 4.1.0, <= 4.1.4; >= 4.2.0, <= 4.2.2), cve.org (>= 4, < 4.2.3), Snyk (>= 4.0.0.RELEASE, < 4.2.3.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.batch/spring-batch-core@4.3.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.batch/spring-batch-core@4.3.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T15:30:49.741847+00:00",
      "status_notes": "Vulnerability CVE-2026-47875 does not affect version 4.3.3-tuxcare.1 of org.springframework.batch:spring-batch-core. not_affected \u2014 Spring Batch 4.3.3 is NOT affected by CVE-2026-47875. The vulnerability affects the arbitrary type deserialization feature introduced in Spring Batch 5.0.0 (commit 2660f2bb2, September 2022). Version 4.3.3 uses a fundamentally different JobParameter implementation that only supports four hardcoded types (STRING, DATE, LONG, DOUBLE) via an enum. The JobParameterDeserializer in 4.3.3 uses Paramet...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-47875"
      },
      "impact_statement": "not_affected \u2014 Spring Batch 4.3.3 is NOT affected by CVE-2026-47875. The vulnerability affects the arbitrary type deserialization feature introduced in Spring Batch 5.0.0 (commit 2660f2bb2, September 2022). Version 4.3.3 uses a fundamentally different JobParameter implementation that only supports four hardcoded types (STRING, DATE, LONG, DOUBLE) via an enum. The JobParameterDeserializer in 4.3.3 uses Paramet..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.batch/spring-batch-core@4.3.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.batch/spring-batch-core@4.3.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-14T08:42:31.976297+00:00",
      "status_notes": "Vulnerability CVE-2026-47878 affects version 4.3.3-tuxcare.1 of org.springframework.batch:spring-batch-core, and is fixed in 4.3.3-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-47878"
      },
      "action_statement": "Vulnerability CVE-2026-47878 affects version 4.3.3-tuxcare.1 of org.springframework.batch:spring-batch-core, and is fixed in 4.3.3-tuxcare.2."
    }
  ]
}