{
  "@id": "urn:uuid:8d944dcd-a340-48b3-8836-cef991b9d562",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-13T14:28:00.093873+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.ws/spring-ws-support@2.4.5.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.ws/spring-ws-support@2.4.5.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-13T14:27:00.082685+00:00",
      "status_notes": "Vulnerability CVE-2019-3773 does not affect version 2.4.5.RELEASE-tuxcare.2 of org.springframework.ws:spring-ws-support. CVE-2019-3773 (XXE vulnerability) is not present in Spring Web Services v2.4.5.RELEASE. The upstream vendor (Pivotal/Spring) fixed this vulnerability in commit d1c87ab466df (SWS-1049) on 2018-12-07, authored by Greg Turnquist. This fix was included in the v2.4.5.RELEASE tag before TuxCare onboarded this version. The fix introduces secure utility wrapper classes (DocumentBuilderFactoryUtils, XMLInputFactoryUtils, TransformerFactoryUtils) that replace direct XML parser factory instantiation and automatically configure XXE protections by disabling external entity processing, DTD support, and external schema access.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3773"
      },
      "impact_statement": "CVE-2019-3773 (XXE vulnerability) is not present in Spring Web Services v2.4.5.RELEASE. The upstream vendor (Pivotal/Spring) fixed this vulnerability in commit d1c87ab466df (SWS-1049) on 2018-12-07, authored by Greg Turnquist. This fix was included in the v2.4.5.RELEASE tag before TuxCare onboarded this version. The fix introduces secure utility wrapper classes (DocumentBuilderFactoryUtils, XMLInputFactoryUtils, TransformerFactoryUtils) that replace direct XML parser factory instantiation and automatically configure XXE protections by disabling external entity processing, DTD support, and external schema access."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.ws/spring-ws-support@2.4.5.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.ws/spring-ws-support@2.4.5.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-13T14:28:00.093873+00:00",
      "status_notes": "Vulnerability CVE-2026-40994 is fixed in version 2.4.5.RELEASE-tuxcare.2 of org.springframework.ws:spring-ws-support.",
      "vulnerability": {
        "name": "CVE-2026-40994"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.ws/spring-ws-support@2.4.5.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.ws/spring-ws-support@2.4.5.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-13T14:28:00.093873+00:00",
      "status_notes": "Vulnerability CVE-2026-40995 is fixed in version 2.4.5.RELEASE-tuxcare.2 of org.springframework.ws:spring-ws-support.",
      "vulnerability": {
        "name": "CVE-2026-40995"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.ws/spring-ws-support@2.4.5.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.ws/spring-ws-support@2.4.5.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-13T14:28:00.093873+00:00",
      "status_notes": "Vulnerability CVE-2026-40996 is fixed in version 2.4.5.RELEASE-tuxcare.2 of org.springframework.ws:spring-ws-support.",
      "vulnerability": {
        "name": "CVE-2026-40996"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.ws/spring-ws-support@2.4.5.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.ws/spring-ws-support@2.4.5.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-13T14:28:00.093873+00:00",
      "status_notes": "Vulnerability CVE-2026-40997 is fixed in version 2.4.5.RELEASE-tuxcare.2 of org.springframework.ws:spring-ws-support.",
      "vulnerability": {
        "name": "CVE-2026-40997"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.ws/spring-ws-support@2.4.5.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.ws/spring-ws-support@2.4.5.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-13T14:28:00.093873+00:00",
      "status_notes": "Vulnerability CVE-2026-40998 is fixed in version 2.4.5.RELEASE-tuxcare.2 of org.springframework.ws:spring-ws-support.",
      "vulnerability": {
        "name": "CVE-2026-40998"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.ws/spring-ws-support@2.4.5.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.ws/spring-ws-support@2.4.5.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-13T14:28:00.093873+00:00",
      "status_notes": "Vulnerability CVE-2026-40999 is fixed in version 2.4.5.RELEASE-tuxcare.2 of org.springframework.ws:spring-ws-support.",
      "vulnerability": {
        "name": "CVE-2026-40999"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.ws/spring-ws-support@2.4.5.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.ws/spring-ws-support@2.4.5.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-13T14:28:00.093873+00:00",
      "status_notes": "Vulnerability CVE-2026-41000 is fixed in version 2.4.5.RELEASE-tuxcare.2 of org.springframework.ws:spring-ws-support.",
      "vulnerability": {
        "name": "CVE-2026-41000"
      }
    }
  ]
}