{
  "@id": "urn:uuid:09a9a9ce-3455-47d0-a381-335dfd9bdc72",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T10:47:42.736684+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/commons-collections/commons-collections-testframework@3.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/commons-collections/commons-collections-testframework@3.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2015-4852 does not affect version 3.2-tuxcare.1 of commons-collections:commons-collections-testframework. Version 3.2 is not vulnerable. Summary: The target repository contains the vulnerable functor classes (InvokerTransformer, InstantiateTransformer, etc.) that are serializable, BUT it has been patched with an effective mitigation that prevents deserialization attacks by default. The mitigation uses runtime checks via FunctorUtils.checkUnsafeSerialization() which throws UnsupportedOperationException unless explicitly enabled via system property.",
      "vulnerability": {
        "name": "CVE-2015-4852"
      },
      "impact_statement": "Version 3.2 is not vulnerable. Summary: The target repository contains the vulnerable functor classes (InvokerTransformer, InstantiateTransformer, etc.) that are serializable, BUT it has been patched with an effective mitigation that prevents deserialization attacks by default. The mitigation uses runtime checks via FunctorUtils.checkUnsafeSerialization() which throws UnsupportedOperationException unless explicitly enabled via system property."
    }
  ]
}