{ "@id": "urn:uuid:7f5739e8-abdd-40a3-b440-8284ccc1b2d4", "role": "Document Creator", "author": "https://tuxcare.com", "version": 35, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-31T06:32:00.080033+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7" } } ], "timestamp": "2026-10-30T12:09:48.333130+00:00", "status_notes": "Vulnerability CVE-2009-1190 does not affect version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm. not_affected \u2014 Spring Framework 4.1.7.RELEASE is not affected by CVE-2009-1190. The vulnerability is fundamentally in JDK < 1.6's Pattern.compile method (algorithmic complexity with regex patterns containing multiple optional groups). This Spring version requires JDK 8, which is 8 years newer than JDK 1.6 where the underlying JDK issue was fixed. The target version (4.1.7.RELEASE from 2015) is also much newer...", "vulnerability": { "name": "CVE-2009-1190" }, "impact_statement": "not_affected \u2014 Spring Framework 4.1.7.RELEASE is not affected by CVE-2009-1190. The vulnerability is fundamentally in JDK < 1.6's Pattern.compile method (algorithmic complexity with regex patterns containing multiple optional groups). This Spring version requires JDK 8, which is 8 years newer than JDK 1.6 where the underlying JDK issue was fixed. The target version (4.1.7.RELEASE from 2015) is also much newer..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7" } } ], "timestamp": "2026-10-28T21:30:41.069534+00:00", "status_notes": "Vulnerability CVE-2011-2730 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm.", "vulnerability": { "name": "CVE-2011-2730" }, "action_statement": "Vulnerability CVE-2011-2730 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7" } } ], "timestamp": "2026-10-29T02:23:11.597840+00:00", "status_notes": "Vulnerability CVE-2011-2894 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm.", "vulnerability": { "name": "CVE-2011-2894" }, "action_statement": "Vulnerability CVE-2011-2894 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7" } } ], "timestamp": "2026-10-31T06:32:00.080033+00:00", "status_notes": "Vulnerability CVE-2013-4152 does not affect version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-4152 (XXE in Spring OXM/JAXB): Target 4.1.7.RELEASE is NOT AFFECTED. The vulnerability was fixed by upstream Spring Framework in Aug 2013 (commit 7576274874d) and further hardened through Feb 2014-Jun 2015. All XXE defenses (SUPPORT_DTD=false, IS_SUPPORTING_EXTERNAL_ENTITIES=false, NO_OP_XML_RESOLVER) were present in the upstream 4.1.7.RELEASE when TuxCare onboarded it. The vulnerable ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2013-4152" }, "impact_statement": "not_affected \u2014 CVE-2013-4152 (XXE in Spring OXM/JAXB): Target 4.1.7.RELEASE is NOT AFFECTED. The vulnerability was fixed by upstream Spring Framework in Aug 2013 (commit 7576274874d) and further hardened through Feb 2014-Jun 2015. All XXE defenses (SUPPORT_DTD=false, IS_SUPPORTING_EXTERNAL_ENTITIES=false, NO_OP_XML_RESOLVER) were present in the upstream 4.1.7.RELEASE when TuxCare onboarded it. The vulnerable ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7" } } ], "timestamp": "2026-10-31T05:11:00.093712+00:00", "status_notes": "Vulnerability CVE-2013-7315 does not affect version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-7315 XXE vulnerability is not present in target version 4.1.7.RELEASE. The upstream fix was already included in the release that TuxCare onboarded. The target code contains comprehensive XXE protections: IS_SUPPORTING_EXTERNAL_ENTITIES=false, SUPPORT_DTD=false, and a NO_OP_XML_RESOLVER. These defenses prevent external entity resolution in XMLInputFactory, blocking the attack vector des...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2013-7315" }, "impact_statement": "not_affected \u2014 CVE-2013-7315 XXE vulnerability is not present in target version 4.1.7.RELEASE. The upstream fix was already included in the release that TuxCare onboarded. The target code contains comprehensive XXE protections: IS_SUPPORTING_EXTERNAL_ENTITIES=false, SUPPORT_DTD=false, and a NO_OP_XML_RESOLVER. These defenses prevent external entity resolution in XMLInputFactory, blocking the attack vector des..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7" } } ], "timestamp": "2026-10-28T23:41:42.084809+00:00", "status_notes": "Vulnerability CVE-2014-3578 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm.", "vulnerability": { "name": "CVE-2014-3578" }, "action_statement": "Vulnerability CVE-2014-3578 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7" } } ], "timestamp": "2026-10-29T13:39:01.836668+00:00", "status_notes": "Vulnerability CVE-2015-0201 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm.", "vulnerability": { "name": "CVE-2015-0201" }, "action_statement": "Vulnerability CVE-2015-0201 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7" } } ], "timestamp": "2026-10-08T12:55:00.631266+00:00", "status_notes": "Vulnerability CVE-2015-5211 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm.", "vulnerability": { "name": "CVE-2015-5211" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7" } } ], "timestamp": "2026-10-08T12:55:00.631266+00:00", "status_notes": "Vulnerability CVE-2016-5007 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm.", "vulnerability": { "name": "CVE-2016-5007" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7" } } ], "timestamp": "2026-10-08T12:55:00.631266+00:00", "status_notes": "Vulnerability CVE-2018-11040 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm.", "vulnerability": { "name": "CVE-2018-11040" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7" } } ], "timestamp": "2026-10-29T00:51:30.888148+00:00", "status_notes": "Vulnerability CVE-2018-1199 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm.", "vulnerability": { "name": "CVE-2018-1199" }, "action_statement": "Vulnerability CVE-2018-1199 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7" } } ], "timestamp": "2026-10-08T12:55:00.631266+00:00", "status_notes": "Vulnerability CVE-2018-1257 does not affect version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm. The version is not vulnerable. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-1257" }, "impact_statement": "The version is not vulnerable. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7" } } ], "timestamp": "2026-10-29T02:48:12.612717+00:00", "status_notes": "Vulnerability CVE-2018-1258 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm.", "vulnerability": { "name": "CVE-2018-1258" }, "action_statement": "Vulnerability CVE-2018-1258 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7" } } ], "timestamp": "2026-10-08T12:55:00.631266+00:00", "status_notes": "Vulnerability CVE-2018-1271 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm.", "vulnerability": { "name": "CVE-2018-1271" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7" } } ], "timestamp": "2026-10-08T12:55:00.631266+00:00", "status_notes": "Vulnerability CVE-2018-1272 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm.", "vulnerability": { "name": "CVE-2018-1272" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7" } } ], "timestamp": "2026-10-28T22:02:19.515243+00:00", "status_notes": "Vulnerability CVE-2018-15756 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm.", "vulnerability": { "name": "CVE-2018-15756" }, "action_statement": "Vulnerability CVE-2018-15756 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7" } } ], "timestamp": "2026-10-28T22:44:11.275398+00:00", "status_notes": "Vulnerability CVE-2021-22060 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm.", "vulnerability": { "name": "CVE-2021-22060" }, "action_statement": "Vulnerability CVE-2021-22060 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7" } } ], "timestamp": "2026-10-08T12:58:00.834390+00:00", "status_notes": "Vulnerability CVE-2021-22096 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm.", "vulnerability": { "name": "CVE-2021-22096" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7" } } ], "timestamp": "2026-10-08T12:55:00.631266+00:00", "status_notes": "Vulnerability CVE-2022-22965 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm.", "vulnerability": { "name": "CVE-2022-22965" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7" } } ], "timestamp": "2026-10-08T12:55:00.631266+00:00", "status_notes": "Vulnerability CVE-2022-22970 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm.", "vulnerability": { "name": "CVE-2022-22970" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7" } } ], "timestamp": "2026-10-29T03:48:46.502543+00:00", "status_notes": "Vulnerability CVE-2024-22233 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm.", "vulnerability": { "name": "CVE-2024-22233" }, "action_statement": "Vulnerability CVE-2024-22233 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7" } } ], "timestamp": "2026-10-08T12:55:00.631266+00:00", "status_notes": "Vulnerability CVE-2025-41249 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm.", "vulnerability": { "name": "CVE-2025-41249" }, "action_statement": "Vulnerability CVE-2025-41249 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7" } } ], "timestamp": "2026-10-08T12:55:00.631266+00:00", "status_notes": "Vulnerability CVE-2026-22740 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm.", "vulnerability": { "name": "CVE-2026-22740" }, "action_statement": "Vulnerability CVE-2026-22740 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7" } } ], "timestamp": "2026-10-08T12:55:00.631266+00:00", "status_notes": "Vulnerability CVE-2026-41848 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm.", "vulnerability": { "name": "CVE-2026-41848" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7", "identifiers": { "purl": "pkg:maven/org.springframework/spring-oxm@4.1.7.RELEASE-tuxcare.7" } } ], "timestamp": "2026-10-08T12:59:00.241204+00:00", "status_notes": "Vulnerability CVE-2026-59282 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-oxm.", "vulnerability": { "name": "CVE-2026-59282" } } ] }