{
  "@id": "urn:uuid:dfe541a4-f46a-4c63-a5b2-bf694a25f666",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 44,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T14:58:56.128088+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-oxm@5.3.39.tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-oxm@5.3.39.tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T06:11:00.190827+00:00",
      "status_notes": "Vulnerability CVE-2013-4152 does not affect version 5.3.39.tuxcare.2 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-4152 (XXE vulnerability in Spring OXM JAXB marshaller) is NOT present in spring-framework 5.3.39-tuxcare.23. The vulnerable pattern was fixed in the upstream release before TuxCare maintenance began. The original fix (commit 7576274874, August 2013) added IS_REPLACING_ENTITY_REFERENCES=false. The code was later enhanced with comprehensive XXE protections (SUPPORT_DTD=false, IS_SUPPORTI...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2013-4152"
      },
      "impact_statement": "not_affected \u2014 CVE-2013-4152 (XXE vulnerability in Spring OXM JAXB marshaller) is NOT present in spring-framework 5.3.39-tuxcare.23. The vulnerable pattern was fixed in the upstream release before TuxCare maintenance began. The original fix (commit 7576274874, August 2013) added IS_REPLACING_ENTITY_REFERENCES=false. The code was later enhanced with comprehensive XXE protections (SUPPORT_DTD=false, IS_SUPPORTI..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-oxm@5.3.39.tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-oxm@5.3.39.tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T04:57:00.138161+00:00",
      "status_notes": "Vulnerability CVE-2013-7315 does not affect version 5.3.39.tuxcare.2 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-7315 (XXE in Spring MVC's Jaxb2CollectionHttpMessageConverter) is not present in this target. The vulnerable code pattern (XMLInputFactory.newInstance() without XXE protection) was fixed by upstream Spring Framework in August 2013 (commit 7576274874), before version 5.3.39 was released. The fix was progressively strengthened over multiple commits (1a8629d408 in Feb 2014, e4651d6b50 in ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2013-7315"
      },
      "impact_statement": "not_affected \u2014 CVE-2013-7315 (XXE in Spring MVC's Jaxb2CollectionHttpMessageConverter) is not present in this target. The vulnerable code pattern (XMLInputFactory.newInstance() without XXE protection) was fixed by upstream Spring Framework in August 2013 (commit 7576274874), before version 5.3.39 was released. The fix was progressively strengthened over multiple commits (1a8629d408 in Feb 2014, e4651d6b50 in ..."
    }
  ]
}