{
  "@id": "urn:uuid:570a6db2-b52f-4126-b4a0-e991b70a97ad",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-05T01:32:30.592517+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.ws/spring-xml@3.1.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.ws/spring-xml@3.1.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T01:32:30.592517+00:00",
      "status_notes": "Vulnerability CVE-2019-3773 does not affect version 3.1.7-tuxcare.3 of org.springframework.ws:spring-xml. The target Spring Web Services 3.1.7-tuxcare.2 is NOT affected by CVE-2019-3773 (XXE vulnerability). The fix for this vulnerability was already present in the upstream Spring Web Services 3.1.7 release, which TuxCare onboarded. The fix introduces secure utility classes (DocumentBuilderFactoryUtils, XMLInputFactoryUtils, TransformerFactoryUtils) that disable external entity processing, and all XML parser instantiations throughout the codebase use these secure wrappers. The vulnerable pattern (direct factory instantiation without XXE protections) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.4.4; >= 3.0.0, < 3.0.6; < 2.4.4; >= 3.0.0, < 3.0.6), Snyk (< 2.4.4.RELEASE; >= 3.0.0.RELEASE, < 3.0.6.RELEASE; < 2.4.4.RELEASE; >= 3.0.0.RELEASE, < 3.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3773"
      },
      "impact_statement": "The target Spring Web Services 3.1.7-tuxcare.2 is NOT affected by CVE-2019-3773 (XXE vulnerability). The fix for this vulnerability was already present in the upstream Spring Web Services 3.1.7 release, which TuxCare onboarded. The fix introduces secure utility classes (DocumentBuilderFactoryUtils, XMLInputFactoryUtils, TransformerFactoryUtils) that disable external entity processing, and all XML parser instantiations throughout the codebase use these secure wrappers. The vulnerable pattern (direct factory instantiation without XXE protections) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.4.4; >= 3.0.0, < 3.0.6; < 2.4.4; >= 3.0.0, < 3.0.6), Snyk (< 2.4.4.RELEASE; >= 3.0.0.RELEASE, < 3.0.6.RELEASE; < 2.4.4.RELEASE; >= 3.0.0.RELEASE, < 3.0.6.RELEASE)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.ws/spring-xml@3.1.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.ws/spring-xml@3.1.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T01:32:30.592517+00:00",
      "status_notes": "Vulnerability CVE-2026-40998 is fixed in version 3.1.7-tuxcare.3 of org.springframework.ws:spring-xml.",
      "vulnerability": {
        "name": "CVE-2026-40998"
      }
    }
  ]
}