{
  "@id": "urn:uuid:45404858-9940-4118-883e-3c90c3989fbf",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 7,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T03:08:00.122443+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-envers@3.3.12-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-envers@3.3.12-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-01T19:34:00.102662+00:00",
      "status_notes": "Vulnerability CVE-2016-6652 affects version 3.3.12-tuxcare.3 of org.springframework.data:spring-data-envers.",
      "vulnerability": {
        "name": "CVE-2016-6652"
      },
      "action_statement": "Vulnerability CVE-2016-6652 affects version 3.3.12-tuxcare.3 of org.springframework.data:spring-data-envers."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-envers@3.3.12-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-envers@3.3.12-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T03:08:00.122443+00:00",
      "status_notes": "Vulnerability CVE-2019-3797 does not affect version 3.3.12-tuxcare.3 of org.springframework.data:spring-data-envers. not_affected \u2014 The target repository (spring-data-jpa version 3.3.12-tuxcare.3) is NOT AFFECTED by CVE-2019-3797. The vulnerability concerns wildcard injection in LIKE queries where user input containing SQL wildcards (_ and %) could match more database rows than intended. The complete fix for this vulnerability was already present in upstream version 3.3.12 before TuxCare onboarded it. The fix includes: (1) ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3797"
      },
      "impact_statement": "not_affected \u2014 The target repository (spring-data-jpa version 3.3.12-tuxcare.3) is NOT AFFECTED by CVE-2019-3797. The vulnerability concerns wildcard injection in LIKE queries where user input containing SQL wildcards (_ and %) could match more database rows than intended. The complete fix for this vulnerability was already present in upstream version 3.3.12 before TuxCare onboarded it. The fix includes: (1) ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-envers@3.3.12-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-envers@3.3.12-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T02:32:55.739745+00:00",
      "status_notes": "Vulnerability CVE-2019-3802 does not affect version 3.3.12-tuxcare.3 of org.springframework.data:spring-data-envers. not_affected \u2014 Spring Data JPA 3.3.12-tuxcare.3 is NOT AFFECTED by CVE-2019-3802. The vulnerability (wildcard injection in Query By Example LIKE patterns) was fixed in upstream Spring Data JPA before the 3.3.12 release. The fix (commit 075b4bad6) escapes SQL wildcards and the escape character itself in user-supplied strings for CONTAINING/STARTING/ENDING matchers. The fix is active by default (EscapeCharacter...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3802"
      },
      "impact_statement": "not_affected \u2014 Spring Data JPA 3.3.12-tuxcare.3 is NOT AFFECTED by CVE-2019-3802. The vulnerability (wildcard injection in Query By Example LIKE patterns) was fixed in upstream Spring Data JPA before the 3.3.12 release. The fix (commit 075b4bad6) escapes SQL wildcards and the escape character itself in user-supplied strings for CONTAINING/STARTING/ENDING matchers. The fix is active by default (EscapeCharacter..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-envers@3.3.12-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-envers@3.3.12-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-19T17:02:00.141161+00:00",
      "status_notes": "Vulnerability CVE-2026-47834 is fixed in version 3.3.12-tuxcare.3 of org.springframework.data:spring-data-envers.",
      "vulnerability": {
        "name": "CVE-2026-47834"
      }
    }
  ]
}