{
  "@id": "urn:uuid:4c25cb02-411e-4372-9d0f-05fc650a55a5",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:51:00.040518+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-cassandra-distribution@3.0.5.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-cassandra-distribution@3.0.5.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T15:42:19.275338+00:00",
      "status_notes": "Vulnerability CVE-2016-3427 is a false positive for org.springframework.data:spring-data-cassandra-distribution 3.0.5.RELEASE-tuxcare.1. CVE-2016-3427 is a false positive for this repository. The CVE affects Oracle Java SE (the JDK/JRE runtime) JMX implementation, not Spring Data for Apache Cassandra. This repository is a data access library that runs ON Java but does not contain or vendor any Oracle JDK/JRE components. No JMX server implementation code exists in the repository - only one test utility file that configures a JMX port system property for embedded Cassandra testing, which is configuration, not vulnerable implementation code.",
      "vulnerability": {
        "name": "CVE-2016-3427"
      },
      "impact_statement": "CVE-2016-3427 is a false positive for this repository. The CVE affects Oracle Java SE (the JDK/JRE runtime) JMX implementation, not Spring Data for Apache Cassandra. This repository is a data access library that runs ON Java but does not contain or vendor any Oracle JDK/JRE components. No JMX server implementation code exists in the repository - only one test utility file that configures a JMX port system property for embedded Cassandra testing, which is configuration, not vulnerable implementation code."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-cassandra-distribution@3.0.5.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-cassandra-distribution@3.0.5.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T15:42:19.275338+00:00",
      "status_notes": "Vulnerability CVE-2019-2684 is a false positive for org.springframework.data:spring-data-cassandra-distribution 3.0.5.RELEASE-tuxcare.1. false_positive \u2014 CVE-2019-2684 is a wrong-project match. The CVE affects Oracle Java SE's RMI (Remote Method Invocation) component, but the target repository is Spring Data for Apache Cassandra 3.0.5.RELEASE, a data access library for Cassandra databases. Exhaustive search found no RMI code, no java.rmi.* imports, no RMI-specific classes (Remote, UnicastRemoteObject, Registry, Naming), no RMI dependencies, and ...",
      "vulnerability": {
        "name": "CVE-2019-2684"
      },
      "impact_statement": "false_positive \u2014 CVE-2019-2684 is a wrong-project match. The CVE affects Oracle Java SE's RMI (Remote Method Invocation) component, but the target repository is Spring Data for Apache Cassandra 3.0.5.RELEASE, a data access library for Cassandra databases. Exhaustive search found no RMI code, no java.rmi.* imports, no RMI-specific classes (Remote, UnicastRemoteObject, Registry, Naming), no RMI dependencies, and ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-cassandra-distribution@3.0.5.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-cassandra-distribution@3.0.5.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T15:42:19.275338+00:00",
      "status_notes": "Vulnerability CVE-2020-13946 does not affect version 3.0.5.RELEASE-tuxcare.1 of org.springframework.data:spring-data-cassandra-distribution. not_affected \u2014 spring-data-cassandra 3.0.5.RELEASE is NOT affected by CVE-2020-13946. This is a client library for connecting to Apache Cassandra databases, not a Cassandra server. The vulnerability exists in the Cassandra server's RMI registry implementation for JMX management, which is not present in this client library. The vulnerable code (RMI registry/JMX server) does not exist in the production source. ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-13946"
      },
      "impact_statement": "not_affected \u2014 spring-data-cassandra 3.0.5.RELEASE is NOT affected by CVE-2020-13946. This is a client library for connecting to Apache Cassandra databases, not a Cassandra server. The vulnerability exists in the Cassandra server's RMI registry implementation for JMX management, which is not present in this client library. The vulnerable code (RMI registry/JMX server) does not exist in the production source. ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-cassandra-distribution@3.0.5.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-cassandra-distribution@3.0.5.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T15:42:19.275338+00:00",
      "status_notes": "Vulnerability CVE-2020-17516 is a false positive for org.springframework.data:spring-data-cassandra-distribution 3.0.5.RELEASE-tuxcare.1. CVE-2020-17516 concerns Apache Cassandra SERVER's internode (server-to-server) encryption bypass vulnerability. The target repository is Spring Data for Apache Cassandra v3.0.5.RELEASE, a Java CLIENT LIBRARY that connects TO Cassandra servers. The vulnerability's attack surface (internode connection requests and server cluster communication) does not exist in client library code. Exhaustive search of 440 production Java files found zero references to internode encryption, ServerEncryptionOptions, InternodeAuthenticator, or related server-side security classes. The only Apache Cassandra server code present is a test-scoped dependency (cassandra-all:3.11.5) used for integration testing via EmbeddedCassandraServerHelper, which does not ship in the production artifact. Type A1 (Rule 5): the Input \"internode connection request\" is not received anywhere in the target's production codebase. Client libraries by architectural design handle client-to-server communication, not server-to-server internode communication.",
      "vulnerability": {
        "name": "CVE-2020-17516"
      },
      "impact_statement": "CVE-2020-17516 concerns Apache Cassandra SERVER's internode (server-to-server) encryption bypass vulnerability. The target repository is Spring Data for Apache Cassandra v3.0.5.RELEASE, a Java CLIENT LIBRARY that connects TO Cassandra servers. The vulnerability's attack surface (internode connection requests and server cluster communication) does not exist in client library code. Exhaustive search of 440 production Java files found zero references to internode encryption, ServerEncryptionOptions, InternodeAuthenticator, or related server-side security classes. The only Apache Cassandra server code present is a test-scoped dependency (cassandra-all:3.11.5) used for integration testing via EmbeddedCassandraServerHelper, which does not ship in the production artifact. Type A1 (Rule 5): the Input \"internode connection request\" is not received anywhere in the target's production codebase. Client libraries by architectural design handle client-to-server communication, not server-to-server internode communication."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-cassandra-distribution@3.0.5.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-cassandra-distribution@3.0.5.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T15:42:19.275338+00:00",
      "status_notes": "Vulnerability CVE-2025-26467 is a false positive for org.springframework.data:spring-data-cassandra-distribution 3.0.5.RELEASE-tuxcare.1. CVE-2025-26467 is a wrong-project match. The advisory concerns Apache Cassandra database server (versions 3.0.30, 3.11.17, 4.0.16, 4.1.7, 5.0.2), which implements server-side authorization and permission checks. This repository is spring-data-cassandra version 3.0.5.RELEASE, a CLIENT LIBRARY that provides Spring Data integration for connecting TO Cassandra databases. The server-side authorization code where the privilege escalation vulnerability exists is not present in this client library. The cassandra-all dependency is test-scoped only for running embedded Cassandra in integration tests, not shipped with the library.",
      "vulnerability": {
        "name": "CVE-2025-26467"
      },
      "impact_statement": "CVE-2025-26467 is a wrong-project match. The advisory concerns Apache Cassandra database server (versions 3.0.30, 3.11.17, 4.0.16, 4.1.7, 5.0.2), which implements server-side authorization and permission checks. This repository is spring-data-cassandra version 3.0.5.RELEASE, a CLIENT LIBRARY that provides Spring Data integration for connecting TO Cassandra databases. The server-side authorization code where the privilege escalation vulnerability exists is not present in this client library. The cassandra-all dependency is test-scoped only for running embedded Cassandra in integration tests, not shipped with the library."
    }
  ]
}