{
  "@id": "urn:uuid:39d69d74-8a18-4501-a5cb-e3c7999e453d",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T11:26:00.030618+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-commons@2.1.5.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-commons@2.1.5.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T11:25:12.012642+00:00",
      "status_notes": "Vulnerability CVE-2018-1259 does not affect version 2.1.5.RELEASE-tuxcare.1 of org.springframework.data:spring-data-commons. Target version 2.1.5.RELEASE already contains the XXE defense from upstream. The fix (commit b8974a292, DATACMNS-1292) was authored by Oliver Gierke (Spring upstream) and shipped in the upstream 2.1.5.RELEASE before TuxCare onboarded it. XmlBeamHttpMessageConverter configures DocumentBuilderFactory to disable DOCTYPE declarations and external entity expansion, blocking the CVE-2018-1259 XXE attack vector. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.13.0, < 1.13.12; >= 2.0.0, < 2.0.7), NVD (>= 1.13, <= 1.13.11; >= 2.0, <= 2.0.6), cve.org (< 1.13.12; < 2.0.7; = 1.13; = 2.0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1259"
      },
      "impact_statement": "Target version 2.1.5.RELEASE already contains the XXE defense from upstream. The fix (commit b8974a292, DATACMNS-1292) was authored by Oliver Gierke (Spring upstream) and shipped in the upstream 2.1.5.RELEASE before TuxCare onboarded it. XmlBeamHttpMessageConverter configures DocumentBuilderFactory to disable DOCTYPE declarations and external entity expansion, blocking the CVE-2018-1259 XXE attack vector. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.13.0, < 1.13.12; >= 2.0.0, < 2.0.7), NVD (>= 1.13, <= 1.13.11; >= 2.0, <= 2.0.6), cve.org (< 1.13.12; < 2.0.7; = 1.13; = 2.0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-commons@2.1.5.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-commons@2.1.5.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T11:25:12.012642+00:00",
      "status_notes": "Vulnerability CVE-2018-1273 does not affect version 2.1.5.RELEASE-tuxcare.1 of org.springframework.data:spring-data-commons. CVE-2018-1273 is NOT present in spring-data-commons 2.1.5.RELEASE. The vulnerability involves Spring Expression Language (SpEL) injection through MapDataBinder's property binding mechanism, which used StandardEvaluationContext allowing arbitrary code execution via malicious request parameters. The fix (DATACMNS-1282) switched to SimpleEvaluationContext, restricting SpEL evaluation to property access only. This fix was authored by Oliver Gierke (ogierke@pivotal.io) from Spring/Pivotal and shipped in upstream version 2.1.5.RELEASE (tag d95675d22, released before TuxCare onboarded the version). The target repository's MapDataBinder.java (lines 204-208) uses SimpleEvaluationContext, confirming the fix is present. First TuxCare commit: 4f4099a59 \"Onboard version 2.1.5.RELEASE\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.13.0, < 1.13.11; >= 2.0.0, < 2.0.6), NVD (<= 1.12.10; >= 1.13.0, <= 1.13.10; >= 2.0.0, <= 2.0.5), Snyk (< 1.13.11.RELEASE; >= 2.0.0.RELEASE, < 2.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1273"
      },
      "impact_statement": "CVE-2018-1273 is NOT present in spring-data-commons 2.1.5.RELEASE. The vulnerability involves Spring Expression Language (SpEL) injection through MapDataBinder's property binding mechanism, which used StandardEvaluationContext allowing arbitrary code execution via malicious request parameters. The fix (DATACMNS-1282) switched to SimpleEvaluationContext, restricting SpEL evaluation to property access only. This fix was authored by Oliver Gierke (ogierke@pivotal.io) from Spring/Pivotal and shipped in upstream version 2.1.5.RELEASE (tag d95675d22, released before TuxCare onboarded the version). The target repository's MapDataBinder.java (lines 204-208) uses SimpleEvaluationContext, confirming the fix is present. First TuxCare commit: 4f4099a59 \"Onboard version 2.1.5.RELEASE\".\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.13.0, < 1.13.11; >= 2.0.0, < 2.0.6), NVD (<= 1.12.10; >= 1.13.0, <= 1.13.10; >= 2.0.0, <= 2.0.5), Snyk (< 1.13.11.RELEASE; >= 2.0.0.RELEASE, < 2.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-commons@2.1.5.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-commons@2.1.5.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T11:25:12.012642+00:00",
      "status_notes": "Vulnerability CVE-2018-1274 does not affect version 2.1.5.RELEASE-tuxcare.1 of org.springframework.data:spring-data-commons. The target version (Spring Data Commons 2.1.5.RELEASE) is not affected by CVE-2018-1274. The vulnerability (unlimited property path parsing depth causing DoS) was fixed by upstream Spring developer Oliver Gierke on April 3, 2018 (commit 06b0dab5), and this fix shipped with the upstream 2.1.5.RELEASE. The code contains a depth check that throws IllegalArgumentException when property path parsing exceeds 1000 segments, preventing the resource exhaustion attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.13.11; >= 2.0.0, < 2.0.6), NVD (< 1.13.11; >= 2.0.0, < 2.0.6), Snyk (< 1.13.11.RELEASE; >= 2.0.0.RELEASE, < 2.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1274"
      },
      "impact_statement": "The target version (Spring Data Commons 2.1.5.RELEASE) is not affected by CVE-2018-1274. The vulnerability (unlimited property path parsing depth causing DoS) was fixed by upstream Spring developer Oliver Gierke on April 3, 2018 (commit 06b0dab5), and this fix shipped with the upstream 2.1.5.RELEASE. The code contains a depth check that throws IllegalArgumentException when property path parsing exceeds 1000 segments, preventing the resource exhaustion attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.13.11; >= 2.0.0, < 2.0.6), NVD (< 1.13.11; >= 2.0.0, < 2.0.6), Snyk (< 1.13.11.RELEASE; >= 2.0.0.RELEASE, < 2.0.6.RELEASE)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-commons@2.1.5.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-commons@2.1.5.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T11:25:12.012642+00:00",
      "status_notes": "Vulnerability CVE-2026-41695 affects version 2.1.5.RELEASE-tuxcare.1 of org.springframework.data:spring-data-commons.",
      "vulnerability": {
        "name": "CVE-2026-41695"
      },
      "action_statement": "Vulnerability CVE-2026-41695 affects version 2.1.5.RELEASE-tuxcare.1 of org.springframework.data:spring-data-commons."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-commons@2.1.5.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-commons@2.1.5.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T11:26:00.030618+00:00",
      "status_notes": "Vulnerability CVE-2026-41711 is fixed in version 2.1.5.RELEASE-tuxcare.1 of org.springframework.data:spring-data-commons.",
      "vulnerability": {
        "name": "CVE-2026-41711"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-commons@2.1.5.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-commons@2.1.5.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T11:25:12.012642+00:00",
      "status_notes": "Vulnerability CVE-2026-41716 affects version 2.1.5.RELEASE-tuxcare.1 of org.springframework.data:spring-data-commons.",
      "vulnerability": {
        "name": "CVE-2026-41716"
      },
      "action_statement": "Vulnerability CVE-2026-41716 affects version 2.1.5.RELEASE-tuxcare.1 of org.springframework.data:spring-data-commons."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-commons@2.1.5.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-commons@2.1.5.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T11:25:12.012642+00:00",
      "status_notes": "Vulnerability CVE-2026-41721 affects version 2.1.5.RELEASE-tuxcare.1 of org.springframework.data:spring-data-commons.",
      "vulnerability": {
        "name": "CVE-2026-41721"
      },
      "action_statement": "Vulnerability CVE-2026-41721 affects version 2.1.5.RELEASE-tuxcare.1 of org.springframework.data:spring-data-commons."
    }
  ]
}