{
  "@id": "urn:uuid:998beb95-79b0-4519-a05b-e68a6d4aae05",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:10:25.284357+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-commons@2.1.3.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-commons@2.1.3.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2018-1259 does not affect version 2.1.3.RELEASE-tuxcare.1 of org.springframework.data:spring-data-commons. The target repository (Spring Data Commons 2.1.3.RELEASE-tuxcare.1) is NOT affected by CVE-2018-1259. The XXE vulnerability fix (DATACMNS-1292) was already present in the upstream 2.1.3.RELEASE when TuxCare onboarded it. The fix commit (b8974a292) was authored by Oliver Gierke (ogierke@pivotal.io) on 2018-04-11 and is an ancestor of the onboarding commit (815a48732). The XmlBeamHttpMessageConverter.java file contains the complete fix: DocumentBuilderFactory is configured to disable DOCTYPE declarations and external entity processing (lines 70-71), preventing XXE attacks. This is an upstream vendor fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.13.0, < 1.13.12; >= 2.0.0, < 2.0.7), NVD (>= 1.13, <= 1.13.11; >= 2.0, <= 2.0.6), cve.org (< 1.13.12; < 2.0.7; = 1.13; = 2.0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1259"
      },
      "impact_statement": "The target repository (Spring Data Commons 2.1.3.RELEASE-tuxcare.1) is NOT affected by CVE-2018-1259. The XXE vulnerability fix (DATACMNS-1292) was already present in the upstream 2.1.3.RELEASE when TuxCare onboarded it. The fix commit (b8974a292) was authored by Oliver Gierke (ogierke@pivotal.io) on 2018-04-11 and is an ancestor of the onboarding commit (815a48732). The XmlBeamHttpMessageConverter.java file contains the complete fix: DocumentBuilderFactory is configured to disable DOCTYPE declarations and external entity processing (lines 70-71), preventing XXE attacks. This is an upstream vendor fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.13.0, < 1.13.12; >= 2.0.0, < 2.0.7), NVD (>= 1.13, <= 1.13.11; >= 2.0, <= 2.0.6), cve.org (< 1.13.12; < 2.0.7; = 1.13; = 2.0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-commons@2.1.3.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-commons@2.1.3.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2018-1273 does not affect version 2.1.3.RELEASE-tuxcare.1 of org.springframework.data:spring-data-commons. The target repository (spring-data-commons 2.1.3.RELEASE-tuxcare.1) is NOT AFFECTED by CVE-2018-1273. The vulnerability involved using StandardEvaluationContext for SpEL expression evaluation in MapDataBinder, which allowed arbitrary code execution through specially crafted request parameters. The fix (switching to SimpleEvaluationContext) was already present in upstream Spring Data Commons 2.1.3.RELEASE before TuxCare onboarded this version. The fixing commit 08d748a6fd by Oliver Gierke is an ancestor of the first TuxCare commit, confirming this is an upstream fix that shipped in the original 2.1.3 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.13.0, < 1.13.11; >= 2.0.0, < 2.0.6), NVD (<= 1.12.10; >= 1.13.0, <= 1.13.10; >= 2.0.0, <= 2.0.5), Snyk (< 1.13.11.RELEASE; >= 2.0.0.RELEASE, < 2.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1273"
      },
      "impact_statement": "The target repository (spring-data-commons 2.1.3.RELEASE-tuxcare.1) is NOT AFFECTED by CVE-2018-1273. The vulnerability involved using StandardEvaluationContext for SpEL expression evaluation in MapDataBinder, which allowed arbitrary code execution through specially crafted request parameters. The fix (switching to SimpleEvaluationContext) was already present in upstream Spring Data Commons 2.1.3.RELEASE before TuxCare onboarded this version. The fixing commit 08d748a6fd by Oliver Gierke is an ancestor of the first TuxCare commit, confirming this is an upstream fix that shipped in the original 2.1.3 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.13.0, < 1.13.11; >= 2.0.0, < 2.0.6), NVD (<= 1.12.10; >= 1.13.0, <= 1.13.10; >= 2.0.0, <= 2.0.5), Snyk (< 1.13.11.RELEASE; >= 2.0.0.RELEASE, < 2.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-commons@2.1.3.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-commons@2.1.3.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2018-1274 does not affect version 2.1.3.RELEASE-tuxcare.1 of org.springframework.data:spring-data-commons. Target version 2.1.3.RELEASE is NOT affected by CVE-2018-1274. The depth limit defense (max 1000 segments) that prevents unbounded resource consumption during property path parsing is already present in the target code. This fix was authored by upstream Spring developer Oliver Gierke (ogierke@pivotal.io) and shipped in upstream release 2.1.3.RELEASE, which TuxCare subsequently onboarded. The CVE affected versions \"prior to 1.13.10, 2.0 to 2.0.5\" - version 2.1.3 is newer and includes the fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.13.11; >= 2.0.0, < 2.0.6), NVD (< 1.13.11; >= 2.0.0, < 2.0.6), Snyk (< 1.13.11.RELEASE; >= 2.0.0.RELEASE, < 2.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1274"
      },
      "impact_statement": "Target version 2.1.3.RELEASE is NOT affected by CVE-2018-1274. The depth limit defense (max 1000 segments) that prevents unbounded resource consumption during property path parsing is already present in the target code. This fix was authored by upstream Spring developer Oliver Gierke (ogierke@pivotal.io) and shipped in upstream release 2.1.3.RELEASE, which TuxCare subsequently onboarded. The CVE affected versions \"prior to 1.13.10, 2.0 to 2.0.5\" - version 2.1.3 is newer and includes the fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.13.11; >= 2.0.0, < 2.0.6), NVD (< 1.13.11; >= 2.0.0, < 2.0.6), Snyk (< 1.13.11.RELEASE; >= 2.0.0.RELEASE, < 2.0.6.RELEASE)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-commons@2.1.3.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-commons@2.1.3.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T06:04:52.803620+00:00",
      "status_notes": "Vulnerability CVE-2026-41695 affects version 2.1.3.RELEASE-tuxcare.1 of org.springframework.data:spring-data-commons.",
      "vulnerability": {
        "name": "CVE-2026-41695"
      },
      "action_statement": "Vulnerability CVE-2026-41695 affects version 2.1.3.RELEASE-tuxcare.1 of org.springframework.data:spring-data-commons."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-commons@2.1.3.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-commons@2.1.3.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T06:04:52.803620+00:00",
      "status_notes": "Vulnerability CVE-2026-41711 affects version 2.1.3.RELEASE-tuxcare.1 of org.springframework.data:spring-data-commons.",
      "vulnerability": {
        "name": "CVE-2026-41711"
      },
      "action_statement": "Vulnerability CVE-2026-41711 affects version 2.1.3.RELEASE-tuxcare.1 of org.springframework.data:spring-data-commons."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-commons@2.1.3.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-commons@2.1.3.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T06:04:52.803620+00:00",
      "status_notes": "Vulnerability CVE-2026-41716 affects version 2.1.3.RELEASE-tuxcare.1 of org.springframework.data:spring-data-commons.",
      "vulnerability": {
        "name": "CVE-2026-41716"
      },
      "action_statement": "Vulnerability CVE-2026-41716 affects version 2.1.3.RELEASE-tuxcare.1 of org.springframework.data:spring-data-commons."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-commons@2.1.3.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-commons@2.1.3.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T06:04:52.803620+00:00",
      "status_notes": "Vulnerability CVE-2026-41721 affects version 2.1.3.RELEASE-tuxcare.1 of org.springframework.data:spring-data-commons.",
      "vulnerability": {
        "name": "CVE-2026-41721"
      },
      "action_statement": "Vulnerability CVE-2026-41721 affects version 2.1.3.RELEASE-tuxcare.1 of org.springframework.data:spring-data-commons."
    }
  ]
}