{
  "@id": "urn:uuid:9f60004d-861b-411f-9c62-8786793c3ac3",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T01:20:33.247405+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.batch/spring-batch-core@4.3.9-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.batch/spring-batch-core@4.3.9-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T01:20:33.247405+00:00",
      "status_notes": "Vulnerability CVE-2019-3774 does not affect version 4.3.9-tuxcare.4 of org.springframework.batch:spring-batch-core. CVE-2019-3774 (XXE vulnerability in Spring Batch XML processing) is not present in spring-batch 4.3.9-tuxcare.3. The fix was applied in upstream commit edfbdbb82 (2019-01-11) which disabled DTD processing and external entity resolution in XMLInputFactory. This fix shipped in the upstream Spring Batch 4.3.9 release before TuxCare onboarding. The target uses Spring Framework's createDefensiveInputFactory() which provides equivalent XXE protection, confirmed by the passing testDtdXml() security test.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.10.RELEASE; >= 4.0.0.RELEASE, < 4.0.2.RELEASE; >= 4.1.0.RELEASE, < 4.1.1.RELEASE), NVD (<= 3.0.9; >= 4.0.0, <= 4.0.1; = 4.1.0), cve.org (>= 4.0, < 4.0.1.RELEASE; >= 4.1, < 4.1.0.RELEASE; >= 3.0, < 3.0.9.RELEASE), Snyk (>= 4.1.0.RELEASE, < 4.1.1.RELEASE; >= 4.0.0.RELEASE, < 4.0.2.RELEASE; >= 3.0.9.RELEASE, < 3.0.10.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3774"
      },
      "impact_statement": "CVE-2019-3774 (XXE vulnerability in Spring Batch XML processing) is not present in spring-batch 4.3.9-tuxcare.3. The fix was applied in upstream commit edfbdbb82 (2019-01-11) which disabled DTD processing and external entity resolution in XMLInputFactory. This fix shipped in the upstream Spring Batch 4.3.9 release before TuxCare onboarding. The target uses Spring Framework's createDefensiveInputFactory() which provides equivalent XXE protection, confirmed by the passing testDtdXml() security test.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.10.RELEASE; >= 4.0.0.RELEASE, < 4.0.2.RELEASE; >= 4.1.0.RELEASE, < 4.1.1.RELEASE), NVD (<= 3.0.9; >= 4.0.0, <= 4.0.1; = 4.1.0), cve.org (>= 4.0, < 4.0.1.RELEASE; >= 4.1, < 4.1.0.RELEASE; >= 3.0, < 3.0.9.RELEASE), Snyk (>= 4.1.0.RELEASE, < 4.1.1.RELEASE; >= 4.0.0.RELEASE, < 4.0.2.RELEASE; >= 3.0.9.RELEASE, < 3.0.10.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.batch/spring-batch-core@4.3.9-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.batch/spring-batch-core@4.3.9-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T01:20:33.247405+00:00",
      "status_notes": "Vulnerability CVE-2020-5411 does not affect version 4.3.9-tuxcare.4 of org.springframework.batch:spring-batch-core. Target version 4.3.9 is not affected by CVE-2020-5411. The vulnerability (unrestricted Jackson default typing enabling arbitrary class deserialization) was fixed by upstream Spring Batch in June 2020 (commit 9a79b4572d0aa4bec38fe90957c850920b7f9cea) and shipped in the 4.3.9 release (August 2023) that TuxCare onboarded. The vulnerable pattern (enableDefaultTyping()) is absent; the target uses TrustedTypeIdResolver with a comprehensive whitelist that blocks untrusted gadget classes during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.2.3), NVD (>= 4.0.0, <= 4.0.4; >= 4.1.0, <= 4.1.4; >= 4.2.0, <= 4.2.2), cve.org (>= 4, < 4.2.3), Snyk (>= 4.0.0.RELEASE, < 4.2.3.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5411"
      },
      "impact_statement": "Target version 4.3.9 is not affected by CVE-2020-5411. The vulnerability (unrestricted Jackson default typing enabling arbitrary class deserialization) was fixed by upstream Spring Batch in June 2020 (commit 9a79b4572d0aa4bec38fe90957c850920b7f9cea) and shipped in the 4.3.9 release (August 2023) that TuxCare onboarded. The vulnerable pattern (enableDefaultTyping()) is absent; the target uses TrustedTypeIdResolver with a comprehensive whitelist that blocks untrusted gadget classes during deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.2.3), NVD (>= 4.0.0, <= 4.0.4; >= 4.1.0, <= 4.1.4; >= 4.2.0, <= 4.2.2), cve.org (>= 4, < 4.2.3), Snyk (>= 4.0.0.RELEASE, < 4.2.3.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.batch/spring-batch-core@4.3.9-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.batch/spring-batch-core@4.3.9-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T01:20:33.247405+00:00",
      "status_notes": "Vulnerability CVE-2026-47875 does not affect version 4.3.9-tuxcare.4 of org.springframework.batch:spring-batch-core. not_affected \u2014 Spring Batch 4.3.9 is not affected by CVE-2026-47875. The vulnerability exists only in Spring Batch 5.0+ where support for arbitrary types in JobParameters was introduced (commit 2660f2bb2, Sept 2022). The 4.3.9 version uses a safe enum-based deserialization that only handles four predefined types (String, Long, Date, Double) and never calls Class.forName with attacker-controlled input. The vul...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-47875"
      },
      "impact_statement": "not_affected \u2014 Spring Batch 4.3.9 is not affected by CVE-2026-47875. The vulnerability exists only in Spring Batch 5.0+ where support for arbitrary types in JobParameters was introduced (commit 2660f2bb2, Sept 2022). The 4.3.9 version uses a safe enum-based deserialization that only handles four predefined types (String, Long, Date, Double) and never calls Class.forName with attacker-controlled input. The vul..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.batch/spring-batch-core@4.3.9-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.batch/spring-batch-core@4.3.9-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T01:20:33.247405+00:00",
      "status_notes": "Vulnerability CVE-2026-47878 is fixed in version 4.3.9-tuxcare.4 of org.springframework.batch:spring-batch-core.",
      "vulnerability": {
        "name": "CVE-2026-47878"
      }
    }
  ]
}