{
  "@id": "urn:uuid:870a732b-3e82-4188-ab08-55623c04d93e",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-08T21:11:00.048806+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@1.7.14.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@1.7.14.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-08T21:10:43.697304+00:00",
      "status_notes": "Vulnerability CVE-2016-2173 does not affect version 1.7.14.RELEASE-tuxcare.3 of org.springframework.amqp:spring-amqp. The target is not affected by CVE-2016-2173. The upstream fix from Spring AMQP 1.5.5 (commit 462dcb6f, March 2016) which adds whitelist-based Java deserialization protection is present in version 1.7.14.RELEASE. The fix introduces WhiteListDeserializingMessageConverter that calls checkWhiteList() during class resolution in deserialization, blocking unauthorized classes. While the whitelist is empty by default (requiring user configuration for full protection), the defense mechanism code is present in the shipped version, distinguishing it from the pre-fix vulnerable state where no protection mechanism existed at all. The vendor considers this opt-in mitigation the authoritative fix for the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.5), Snyk (< 1.5.5).",
      "vulnerability": {
        "name": "CVE-2016-2173"
      },
      "impact_statement": "The target is not affected by CVE-2016-2173. The upstream fix from Spring AMQP 1.5.5 (commit 462dcb6f, March 2016) which adds whitelist-based Java deserialization protection is present in version 1.7.14.RELEASE. The fix introduces WhiteListDeserializingMessageConverter that calls checkWhiteList() during class resolution in deserialization, blocking unauthorized classes. While the whitelist is empty by default (requiring user configuration for full protection), the defense mechanism code is present in the shipped version, distinguishing it from the pre-fix vulnerable state where no protection mechanism existed at all. The vendor considers this opt-in mitigation the authoritative fix for the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.5), Snyk (< 1.5.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@1.7.14.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@1.7.14.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-08T21:10:43.697304+00:00",
      "status_notes": "Vulnerability CVE-2017-8045 does not affect version 1.7.14.RELEASE-tuxcare.3 of org.springframework.amqp:spring-amqp. CVE-2017-8045 concerns unsafe deserialization in Spring AMQP's Message.toString() method, which could enable remote code execution when malicious serialized objects are converted to strings (e.g., during logging). The target version 1.7.14.RELEASE already contains the upstream fix (commit 296d481f9, AMQP-766) introduced by Gary Russell from Pivotal in September 2017. The fix prevents deserialization by returning the safe string \"[serialized object]\" when the message body contains serialized objects. This fix was shipped in the upstream v1.7.14.RELEASE that TuxCare onboarded, making the target not affected by this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.7; >= 1.6.0, < 1.6.11; >= 1.7.0, < 1.7.4), cve.org (< 1.7.4; = 1.6.11; = 1.5.7), Snyk (>= 1.5.6.RELEASE, < 1.5.7.RELEASE; >= 1.6.10.RELEASE, < 1.6.11.RELEASE; >= 1.7.3.RELEASE, < 1.7.4.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-8045"
      },
      "impact_statement": "CVE-2017-8045 concerns unsafe deserialization in Spring AMQP's Message.toString() method, which could enable remote code execution when malicious serialized objects are converted to strings (e.g., during logging). The target version 1.7.14.RELEASE already contains the upstream fix (commit 296d481f9, AMQP-766) introduced by Gary Russell from Pivotal in September 2017. The fix prevents deserialization by returning the safe string \"[serialized object]\" when the message body contains serialized objects. This fix was shipped in the upstream v1.7.14.RELEASE that TuxCare onboarded, making the target not affected by this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.7; >= 1.6.0, < 1.6.11; >= 1.7.0, < 1.7.4), cve.org (< 1.7.4; = 1.6.11; = 1.5.7), Snyk (>= 1.5.6.RELEASE, < 1.5.7.RELEASE; >= 1.6.10.RELEASE, < 1.6.11.RELEASE; >= 1.7.3.RELEASE, < 1.7.4.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@1.7.14.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@1.7.14.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-08T21:10:43.697304+00:00",
      "status_notes": "Vulnerability CVE-2018-11087 does not affect version 1.7.14.RELEASE-tuxcare.3 of org.springframework.amqp:spring-amqp. not_affected \u2014 CVE-2018-11087 is not present in Spring AMQP 1.7.14.RELEASE. The fix (commit aff4d0aef) was shipped in the upstream release and adds hostname verification capability via RabbitConnectionFactoryBean.setEnableHostnameVerification(). While disabled by default in 1.x (enabled by default in 2.x per patch 3), Rule 3 explicitly classifies \"disable-by-default\" as a valid fix strategy. The defense code ...",
      "vulnerability": {
        "name": "CVE-2018-11087"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-11087 is not present in Spring AMQP 1.7.14.RELEASE. The fix (commit aff4d0aef) was shipped in the upstream release and adds hostname verification capability via RabbitConnectionFactoryBean.setEnableHostnameVerification(). While disabled by default in 1.x (enabled by default in 2.x per patch 3), Rule 3 explicitly classifies \"disable-by-default\" as a valid fix strategy. The defense code ..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@1.7.14.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@1.7.14.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-08T21:10:43.697304+00:00",
      "status_notes": "Vulnerability CVE-2021-22095 is fixed in version 1.7.14.RELEASE-tuxcare.3 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2021-22095"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@1.7.14.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@1.7.14.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-08T21:10:43.697304+00:00",
      "status_notes": "Vulnerability CVE-2021-22097 is fixed in version 1.7.14.RELEASE-tuxcare.3 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2021-22097"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@1.7.14.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@1.7.14.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-08T21:11:00.048806+00:00",
      "status_notes": "Vulnerability CVE-2026-41701 is fixed in version 1.7.14.RELEASE-tuxcare.3 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-41701"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@1.7.14.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@1.7.14.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-08T21:11:00.048806+00:00",
      "status_notes": "Vulnerability CVE-2026-41714 is fixed in version 1.7.14.RELEASE-tuxcare.3 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-41714"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@1.7.14.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@1.7.14.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-08T21:10:43.697304+00:00",
      "status_notes": "Vulnerability CVE-2026-47860 is fixed in version 1.7.14.RELEASE-tuxcare.3 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-47860"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@1.7.14.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@1.7.14.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-08T21:10:43.697304+00:00",
      "status_notes": "Vulnerability CVE-2026-59275 is fixed in version 1.7.14.RELEASE-tuxcare.3 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-59275"
      }
    }
  ]
}