{
  "@id": "urn:uuid:317c6392-b343-47a6-bbe4-3b3e3cc91db4",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 6,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T18:30:22.525196+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-jpa@2.4.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-jpa@2.4.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T18:30:22.525196+00:00",
      "status_notes": "Vulnerability CVE-2016-6652 does not affect version 2.4.9-tuxcare.1 of org.springframework.data:spring-data-jpa. not_affected \u2014 The target repository (spring-data-jpa 2.4.9-tuxcare.3) is NOT affected by CVE-2016-6652. The vulnerability was fixed in upstream Spring Data JPA via DATAJPA-965 commits, and this fix was already present in the upstream 2.4.9 release that TuxCare onboarded. The fix adds validation to reject Sort expressions containing functions/JPQL commands unless explicitly marked as \"unsafe\" via JpaSort.unsa...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-6652"
      },
      "impact_statement": "not_affected \u2014 The target repository (spring-data-jpa 2.4.9-tuxcare.3) is NOT affected by CVE-2016-6652. The vulnerability was fixed in upstream Spring Data JPA via DATAJPA-965 commits, and this fix was already present in the upstream 2.4.9 release that TuxCare onboarded. The fix adds validation to reject Sort expressions containing functions/JPQL commands unless explicitly marked as \"unsafe\" via JpaSort.unsa..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-jpa@2.4.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-jpa@2.4.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T03:08:00.122443+00:00",
      "status_notes": "Vulnerability CVE-2019-3797 does not affect version 2.4.9-tuxcare.1 of org.springframework.data:spring-data-jpa. not_affected \u2014 CVE-2019-3797 affects Spring Data JPA versions up to 2.1.5, 2.0.13, and 1.11.19. The vulnerability allows malicious query parameter values containing SQL LIKE wildcards (_, %) to return more results than intended in derived queries using contains, startsWith, or endsWith predicates. The target repository (spring-data-jpa version 2.4.9-tuxcare.3) is NOT vulnerable because the fix was already pre...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3797"
      },
      "impact_statement": "not_affected \u2014 CVE-2019-3797 affects Spring Data JPA versions up to 2.1.5, 2.0.13, and 1.11.19. The vulnerability allows malicious query parameter values containing SQL LIKE wildcards (_, %) to return more results than intended in derived queries using contains, startsWith, or endsWith predicates. The target repository (spring-data-jpa version 2.4.9-tuxcare.3) is NOT vulnerable because the fix was already pre..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-jpa@2.4.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-jpa@2.4.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T02:34:27.229412+00:00",
      "status_notes": "Vulnerability CVE-2019-3802 does not affect version 2.4.9-tuxcare.1 of org.springframework.data:spring-data-jpa. not_affected \u2014 Spring Data JPA 2.4.9 is not affected by CVE-2019-3802. The vulnerability affects versions up to 2.1.6, 2.0.14, and 1.11.20. The fix for wildcard escaping in Query By Example (QBE) was applied by upstream Spring engineers in commit 075b4bad6 (April 2019) and was already present in the upstream 2.4.9 release (May 2021) that TuxCare onboarded. The vulnerable pattern (unescaped wildcards in LIKE q...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3802"
      },
      "impact_statement": "not_affected \u2014 Spring Data JPA 2.4.9 is not affected by CVE-2019-3802. The vulnerability affects versions up to 2.1.6, 2.0.14, and 1.11.20. The fix for wildcard escaping in Query By Example (QBE) was applied by upstream Spring engineers in commit 075b4bad6 (April 2019) and was already present in the upstream 2.4.9 release (May 2021) that TuxCare onboarded. The vulnerable pattern (unescaped wildcards in LIKE q..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-jpa@2.4.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-jpa@2.4.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T18:45:57.071664+00:00",
      "status_notes": "Vulnerability CVE-2026-47834 affects version 2.4.9-tuxcare.1 of org.springframework.data:spring-data-jpa.",
      "vulnerability": {
        "name": "CVE-2026-47834"
      },
      "action_statement": "Vulnerability CVE-2026-47834 affects version 2.4.9-tuxcare.1 of org.springframework.data:spring-data-jpa."
    }
  ]
}