{
  "@id": "urn:uuid:d01b9aca-3053-4f20-a2e7-b6b6c045b85d",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-28T15:42:19.275338+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-cassandra@3.0.5.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-cassandra@3.0.5.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T15:42:19.275338+00:00",
      "status_notes": "Vulnerability CVE-2016-3427 is a false positive for org.springframework.data:spring-data-cassandra 3.0.5.RELEASE-tuxcare.1. CVE-2016-3427 is a false positive for this repository. The CVE affects Oracle Java SE (the JDK/JRE runtime) JMX implementation, not Spring Data for Apache Cassandra. This repository is a data access library that runs ON Java but does not contain or vendor any Oracle JDK/JRE components. No JMX server implementation code exists in the repository - only one test utility file that configures a JMX port system property for embedded Cassandra testing, which is configuration, not vulnerable implementation code.",
      "vulnerability": {
        "name": "CVE-2016-3427"
      },
      "impact_statement": "CVE-2016-3427 is a false positive for this repository. The CVE affects Oracle Java SE (the JDK/JRE runtime) JMX implementation, not Spring Data for Apache Cassandra. This repository is a data access library that runs ON Java but does not contain or vendor any Oracle JDK/JRE components. No JMX server implementation code exists in the repository - only one test utility file that configures a JMX port system property for embedded Cassandra testing, which is configuration, not vulnerable implementation code."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-cassandra@3.0.5.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-cassandra@3.0.5.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T15:42:19.275338+00:00",
      "status_notes": "Vulnerability CVE-2019-2684 is a false positive for org.springframework.data:spring-data-cassandra 3.0.5.RELEASE-tuxcare.1. false_positive \u2014 CVE-2019-2684 is a wrong-project match. The CVE affects Oracle Java SE's RMI (Remote Method Invocation) component, but the target repository is Spring Data for Apache Cassandra 3.0.5.RELEASE, a data access library for Cassandra databases. Exhaustive search found no RMI code, no java.rmi.* imports, no RMI-specific classes (Remote, UnicastRemoteObject, Registry, Naming), no RMI dependencies, and ...",
      "vulnerability": {
        "name": "CVE-2019-2684"
      },
      "impact_statement": "false_positive \u2014 CVE-2019-2684 is a wrong-project match. The CVE affects Oracle Java SE's RMI (Remote Method Invocation) component, but the target repository is Spring Data for Apache Cassandra 3.0.5.RELEASE, a data access library for Cassandra databases. Exhaustive search found no RMI code, no java.rmi.* imports, no RMI-specific classes (Remote, UnicastRemoteObject, Registry, Naming), no RMI dependencies, and ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-cassandra@3.0.5.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-cassandra@3.0.5.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T15:42:19.275338+00:00",
      "status_notes": "Vulnerability CVE-2020-13946 does not affect version 3.0.5.RELEASE-tuxcare.1 of org.springframework.data:spring-data-cassandra. not_affected \u2014 spring-data-cassandra 3.0.5.RELEASE is NOT affected by CVE-2020-13946. This is a client library for connecting to Apache Cassandra databases, not a Cassandra server. The vulnerability exists in the Cassandra server's RMI registry implementation for JMX management, which is not present in this client library. The vulnerable code (RMI registry/JMX server) does not exist in the production source. ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-13946"
      },
      "impact_statement": "not_affected \u2014 spring-data-cassandra 3.0.5.RELEASE is NOT affected by CVE-2020-13946. This is a client library for connecting to Apache Cassandra databases, not a Cassandra server. The vulnerability exists in the Cassandra server's RMI registry implementation for JMX management, which is not present in this client library. The vulnerable code (RMI registry/JMX server) does not exist in the production source. ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-cassandra@3.0.5.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-cassandra@3.0.5.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T15:42:19.275338+00:00",
      "status_notes": "Vulnerability CVE-2020-17516 is a false positive for org.springframework.data:spring-data-cassandra 3.0.5.RELEASE-tuxcare.1. CVE-2020-17516 concerns Apache Cassandra SERVER's internode (server-to-server) encryption bypass vulnerability. The target repository is Spring Data for Apache Cassandra v3.0.5.RELEASE, a Java CLIENT LIBRARY that connects TO Cassandra servers. The vulnerability's attack surface (internode connection requests and server cluster communication) does not exist in client library code. Exhaustive search of 440 production Java files found zero references to internode encryption, ServerEncryptionOptions, InternodeAuthenticator, or related server-side security classes. The only Apache Cassandra server code present is a test-scoped dependency (cassandra-all:3.11.5) used for integration testing via EmbeddedCassandraServerHelper, which does not ship in the production artifact. Type A1 (Rule 5): the Input \"internode connection request\" is not received anywhere in the target's production codebase. Client libraries by architectural design handle client-to-server communication, not server-to-server internode communication.",
      "vulnerability": {
        "name": "CVE-2020-17516"
      },
      "impact_statement": "CVE-2020-17516 concerns Apache Cassandra SERVER's internode (server-to-server) encryption bypass vulnerability. The target repository is Spring Data for Apache Cassandra v3.0.5.RELEASE, a Java CLIENT LIBRARY that connects TO Cassandra servers. The vulnerability's attack surface (internode connection requests and server cluster communication) does not exist in client library code. Exhaustive search of 440 production Java files found zero references to internode encryption, ServerEncryptionOptions, InternodeAuthenticator, or related server-side security classes. The only Apache Cassandra server code present is a test-scoped dependency (cassandra-all:3.11.5) used for integration testing via EmbeddedCassandraServerHelper, which does not ship in the production artifact. Type A1 (Rule 5): the Input \"internode connection request\" is not received anywhere in the target's production codebase. Client libraries by architectural design handle client-to-server communication, not server-to-server internode communication."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-cassandra@3.0.5.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-cassandra@3.0.5.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T15:42:19.275338+00:00",
      "status_notes": "Vulnerability CVE-2021-44521 is a false positive for org.springframework.data:spring-data-cassandra 3.0.5.RELEASE-tuxcare.1. CVE-2021-44521 affects Apache Cassandra **server**'s UDF execution engine. The target is spring-data-cassandra 3.0.5.RELEASE, a **client library** that connects to Cassandra servers. The client does not execute UDFs, does not have a UDF execution engine, and does not process UDF code. All four patches are DOC-ONLY (modify only pom.xml and setup-cassandra.sh), upgrading the TEST-SCOPED Cassandra dependency from 3.11.5/3.11.10/3.11.11 to 3.11.12. The patches fix the test infrastructure, not the library code. Type A1 analysis confirms the INPUT (UDF code) is not received anywhere in spring-data-cassandra. The vulnerability is server-side; client libraries that merely communicate with Cassandra are not vulnerable to the server's code execution vulnerability.",
      "vulnerability": {
        "name": "CVE-2021-44521"
      },
      "impact_statement": "CVE-2021-44521 affects Apache Cassandra **server**'s UDF execution engine. The target is spring-data-cassandra 3.0.5.RELEASE, a **client library** that connects to Cassandra servers. The client does not execute UDFs, does not have a UDF execution engine, and does not process UDF code. All four patches are DOC-ONLY (modify only pom.xml and setup-cassandra.sh), upgrading the TEST-SCOPED Cassandra dependency from 3.11.5/3.11.10/3.11.11 to 3.11.12. The patches fix the test infrastructure, not the library code. Type A1 analysis confirms the INPUT (UDF code) is not received anywhere in spring-data-cassandra. The vulnerability is server-side; client libraries that merely communicate with Cassandra are not vulnerable to the server's code execution vulnerability."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-cassandra@3.0.5.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-cassandra@3.0.5.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T15:42:19.275338+00:00",
      "status_notes": "Vulnerability CVE-2025-23015 is a false positive for org.springframework.data:spring-data-cassandra 3.0.5.RELEASE-tuxcare.1. CVE-2025-23015 is a server-side privilege escalation vulnerability in Apache Cassandra database server. The target repository (spring-data-cassandra v3.0.5.RELEASE) is a CLIENT LIBRARY for connecting Java/Spring applications to Cassandra servers, not the database server itself. The vulnerability's input (user with MODIFY permissions escalating to superuser) is managed entirely by Cassandra's server-side authorization system. spring-data-cassandra does not implement user management, authorization, or permission handling\u2014it only sends CQL queries via the DataStax Java Driver. The vulnerable code path does not exist in this client library. The test-scoped dependency on cassandra-all:3.11.5 is used only for running embedded Cassandra in integration tests and does not make the client library itself vulnerable to a server-side privilege escalation bug.",
      "vulnerability": {
        "name": "CVE-2025-23015"
      },
      "impact_statement": "CVE-2025-23015 is a server-side privilege escalation vulnerability in Apache Cassandra database server. The target repository (spring-data-cassandra v3.0.5.RELEASE) is a CLIENT LIBRARY for connecting Java/Spring applications to Cassandra servers, not the database server itself. The vulnerability's input (user with MODIFY permissions escalating to superuser) is managed entirely by Cassandra's server-side authorization system. spring-data-cassandra does not implement user management, authorization, or permission handling\u2014it only sends CQL queries via the DataStax Java Driver. The vulnerable code path does not exist in this client library. The test-scoped dependency on cassandra-all:3.11.5 is used only for running embedded Cassandra in integration tests and does not make the client library itself vulnerable to a server-side privilege escalation bug."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-cassandra@3.0.5.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-cassandra@3.0.5.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T15:42:19.275338+00:00",
      "status_notes": "Vulnerability CVE-2025-26467 is a false positive for org.springframework.data:spring-data-cassandra 3.0.5.RELEASE-tuxcare.1. CVE-2025-26467 is a wrong-project match. The advisory concerns Apache Cassandra database server (versions 3.0.30, 3.11.17, 4.0.16, 4.1.7, 5.0.2), which implements server-side authorization and permission checks. This repository is spring-data-cassandra version 3.0.5.RELEASE, a CLIENT LIBRARY that provides Spring Data integration for connecting TO Cassandra databases. The server-side authorization code where the privilege escalation vulnerability exists is not present in this client library. The cassandra-all dependency is test-scoped only for running embedded Cassandra in integration tests, not shipped with the library.",
      "vulnerability": {
        "name": "CVE-2025-26467"
      },
      "impact_statement": "CVE-2025-26467 is a wrong-project match. The advisory concerns Apache Cassandra database server (versions 3.0.30, 3.11.17, 4.0.16, 4.1.7, 5.0.2), which implements server-side authorization and permission checks. This repository is spring-data-cassandra version 3.0.5.RELEASE, a CLIENT LIBRARY that provides Spring Data integration for connecting TO Cassandra databases. The server-side authorization code where the privilege escalation vulnerability exists is not present in this client library. The cassandra-all dependency is test-scoped only for running embedded Cassandra in integration tests, not shipped with the library."
    }
  ]
}