{
  "@id": "urn:uuid:b5b6db03-6aec-423f-a8ba-c352579e9682",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 8,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:02:00.202619+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.batch/spring-batch-core@5.1.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.batch/spring-batch-core@5.1.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T11:59:58.922832+00:00",
      "status_notes": "Vulnerability CVE-2019-3774 does not affect version 5.1.2-tuxcare.4 of org.springframework.batch:spring-batch-core. CVE-2019-3774 (XXE in Spring Batch XML parsing) is NOT present in the target. The vulnerable pattern (using XMLInputFactory.newInstance() without security settings) has been replaced by Spring Framework's StaxUtils.createDefensiveInputFactory() which disables DTD processing, external entity resolution, and installs a no-op XML resolver. This fix was introduced by upstream Spring Batch in Sept 2020 (commit 264243b73 by Mahmoud Ben Hassine) when they deprecated their own StaxUtils in favor of Spring Framework's implementation, and shipped in the upstream 5.1.2 release before TuxCare's onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.10.RELEASE; >= 4.0.0.RELEASE, < 4.0.2.RELEASE; >= 4.1.0.RELEASE, < 4.1.1.RELEASE), NVD (<= 3.0.9; >= 4.0.0, <= 4.0.1; = 4.1.0), cve.org (>= 4.0, < 4.0.1.RELEASE; >= 4.1, < 4.1.0.RELEASE; >= 3.0, < 3.0.9.RELEASE), Snyk (>= 4.1.0.RELEASE, < 4.1.1.RELEASE; >= 4.0.0.RELEASE, < 4.0.2.RELEASE; >= 3.0.9.RELEASE, < 3.0.10.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3774"
      },
      "impact_statement": "CVE-2019-3774 (XXE in Spring Batch XML parsing) is NOT present in the target. The vulnerable pattern (using XMLInputFactory.newInstance() without security settings) has been replaced by Spring Framework's StaxUtils.createDefensiveInputFactory() which disables DTD processing, external entity resolution, and installs a no-op XML resolver. This fix was introduced by upstream Spring Batch in Sept 2020 (commit 264243b73 by Mahmoud Ben Hassine) when they deprecated their own StaxUtils in favor of Spring Framework's implementation, and shipped in the upstream 5.1.2 release before TuxCare's onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.10.RELEASE; >= 4.0.0.RELEASE, < 4.0.2.RELEASE; >= 4.1.0.RELEASE, < 4.1.1.RELEASE), NVD (<= 3.0.9; >= 4.0.0, <= 4.0.1; = 4.1.0), cve.org (>= 4.0, < 4.0.1.RELEASE; >= 4.1, < 4.1.0.RELEASE; >= 3.0, < 3.0.9.RELEASE), Snyk (>= 4.1.0.RELEASE, < 4.1.1.RELEASE; >= 4.0.0.RELEASE, < 4.0.2.RELEASE; >= 3.0.9.RELEASE, < 3.0.10.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.batch/spring-batch-core@5.1.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.batch/spring-batch-core@5.1.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:02:00.202619+00:00",
      "status_notes": "Vulnerability CVE-2020-5411 does not affect version 5.1.2-tuxcare.4 of org.springframework.batch:spring-batch-core. CVE-2020-5411 is not present in Spring Batch 5.1.2-tuxcare.5. The vulnerability (unrestricted Jackson default typing enabling arbitrary code execution) was fixed in the upstream Spring Batch 5.1.2 release before TuxCare onboarded it. The fix commit 9a79b4572 by upstream author mbenhassine@vmware.com replaced the vulnerable `enableDefaultTyping()` call with a whitelist-based type validation system using TrustedTypeIdResolver, which blocks deserialization of non-whitelisted classes unless explicitly marked safe via Jackson annotations or mixins.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.2.3), NVD (>= 4.0.0, <= 4.0.4; >= 4.1.0, <= 4.1.4; >= 4.2.0, <= 4.2.2), cve.org (>= 4, < 4.2.3), Snyk (>= 4.0.0.RELEASE, < 4.2.3.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5411"
      },
      "impact_statement": "CVE-2020-5411 is not present in Spring Batch 5.1.2-tuxcare.5. The vulnerability (unrestricted Jackson default typing enabling arbitrary code execution) was fixed in the upstream Spring Batch 5.1.2 release before TuxCare onboarded it. The fix commit 9a79b4572 by upstream author mbenhassine@vmware.com replaced the vulnerable `enableDefaultTyping()` call with a whitelist-based type validation system using TrustedTypeIdResolver, which blocks deserialization of non-whitelisted classes unless explicitly marked safe via Jackson annotations or mixins.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.2.3), NVD (>= 4.0.0, <= 4.0.4; >= 4.1.0, <= 4.1.4; >= 4.2.0, <= 4.2.2), cve.org (>= 4, < 4.2.3), Snyk (>= 4.0.0.RELEASE, < 4.2.3.RELEASE)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.batch/spring-batch-core@5.1.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.batch/spring-batch-core@5.1.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-14T08:31:22.546957+00:00",
      "status_notes": "Vulnerability CVE-2026-47875 affects version 5.1.2-tuxcare.4 of org.springframework.batch:spring-batch-core, and is fixed in 5.1.2-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-47875"
      },
      "action_statement": "Vulnerability CVE-2026-47875 affects version 5.1.2-tuxcare.4 of org.springframework.batch:spring-batch-core, and is fixed in 5.1.2-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.batch/spring-batch-core@5.1.2-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.batch/spring-batch-core@5.1.2-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-14T08:31:22.546957+00:00",
      "status_notes": "Vulnerability CVE-2026-47878 affects version 5.1.2-tuxcare.4 of org.springframework.batch:spring-batch-core, and is fixed in 5.1.2-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-47878"
      },
      "action_statement": "Vulnerability CVE-2026-47878 affects version 5.1.2-tuxcare.4 of org.springframework.batch:spring-batch-core, and is fixed in 5.1.2-tuxcare.5."
    }
  ]
}