{
  "@id": "urn:uuid:d86a22b5-cf02-4463-8597-8c71078195ec",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-08T17:28:41.428166+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.0.3.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.0.3.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-08T17:28:10.450273+00:00",
      "status_notes": "Vulnerability CVE-2016-2173 does not affect version 2.0.3.RELEASE-tuxcare.2 of org.springframework.amqp:spring-amqp. CVE-2016-2173 affects Spring AMQP before 1.5.5. The target repository is version 2.0.3.RELEASE, which already contains the upstream fix (commit 462dcb6) that introduced WhiteListDeserializingMessageConverter with class whitelist checking during Java deserialization. The fix was shipped in the upstream 2.0.3.RELEASE before TuxCare onboarded it, so the vulnerable unrestricted deserialization pattern is not present in the target.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-2173"
      },
      "impact_statement": "CVE-2016-2173 affects Spring AMQP before 1.5.5. The target repository is version 2.0.3.RELEASE, which already contains the upstream fix (commit 462dcb6) that introduced WhiteListDeserializingMessageConverter with class whitelist checking during Java deserialization. The fix was shipped in the upstream 2.0.3.RELEASE before TuxCare onboarded it, so the vulnerable unrestricted deserialization pattern is not present in the target."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.0.3.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.0.3.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-08T17:28:10.450273+00:00",
      "status_notes": "Vulnerability CVE-2017-8045 does not affect version 2.0.3.RELEASE-tuxcare.2 of org.springframework.amqp:spring-amqp. CVE-2017-8045 affects Spring AMQP before 1.5.7, 1.6.0\u20131.6.10 and 1.7.0\u20131.7.3 (Spring advisory, NVD); it is fixed upstream in 1.5.7, 1.6.11 and 1.7.4. Version 2.0.3.RELEASE is later than every fixed release and already contains the upstream fix, so the unsafe deserialization in Message.toString() is not present.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-8045"
      },
      "impact_statement": "CVE-2017-8045 affects Spring AMQP before 1.5.7, 1.6.0\u20131.6.10 and 1.7.0\u20131.7.3 (Spring advisory, NVD); it is fixed upstream in 1.5.7, 1.6.11 and 1.7.4. Version 2.0.3.RELEASE is later than every fixed release and already contains the upstream fix, so the unsafe deserialization in Message.toString() is not present."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.0.3.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.0.3.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-08T17:28:10.450273+00:00",
      "status_notes": "Vulnerability CVE-2018-11087 affects version 2.0.3.RELEASE-tuxcare.2 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2018-11087"
      },
      "action_statement": "Vulnerability CVE-2018-11087 affects version 2.0.3.RELEASE-tuxcare.2 of org.springframework.amqp:spring-amqp."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.0.3.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.0.3.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-08T17:28:41.428166+00:00",
      "status_notes": "Vulnerability CVE-2021-22095 is fixed in version 2.0.3.RELEASE-tuxcare.2 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2021-22095"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.0.3.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.0.3.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-08T17:28:41.428166+00:00",
      "status_notes": "Vulnerability CVE-2021-22097 is fixed in version 2.0.3.RELEASE-tuxcare.2 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2021-22097"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.0.3.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.0.3.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-08T17:28:41.428166+00:00",
      "status_notes": "Vulnerability CVE-2026-41701 is fixed in version 2.0.3.RELEASE-tuxcare.2 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-41701"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.0.3.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.0.3.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-08T17:28:41.428166+00:00",
      "status_notes": "Vulnerability CVE-2026-41714 is fixed in version 2.0.3.RELEASE-tuxcare.2 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-41714"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.0.3.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.0.3.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-08T17:28:41.428166+00:00",
      "status_notes": "Vulnerability CVE-2026-47860 is fixed in version 2.0.3.RELEASE-tuxcare.2 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-47860"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.0.3.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.0.3.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-08T17:28:10.450273+00:00",
      "status_notes": "Vulnerability CVE-2026-59275 does not affect version 2.0.3.RELEASE-tuxcare.2 of org.springframework.amqp:spring-amqp. not_affected \u2014 Version 2.0.3.RELEASE does not contain the JavaLangErrorHandler code path that calls System.exit(99) when errors occur. The specific vulnerability described in CVE-2026-59275 (JVM termination via System.exit(99) from a hostile AMQP message) cannot occur because the javaLangErrorHandler field and its System.exit behavior were introduced in later versions (circa 2.2.12). While the target can rece...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-59275"
      },
      "impact_statement": "not_affected \u2014 Version 2.0.3.RELEASE does not contain the JavaLangErrorHandler code path that calls System.exit(99) when errors occur. The specific vulnerability described in CVE-2026-59275 (JVM termination via System.exit(99) from a hostile AMQP message) cannot occur because the javaLangErrorHandler field and its System.exit behavior were introduced in later versions (circa 2.2.12). While the target can rece..."
    }
  ]
}