{
  "@id": "urn:uuid:0f10cee4-72b0-4af6-baa4-31c22aa5423f",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 7,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:10:25.284357+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.17.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.17.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2016-2173 does not affect version 2.1.17.RELEASE-tuxcare.1 of org.springframework.amqp:spring-amqp. CVE-2016-2173 affects Spring AMQP versions before 1.5.5 due to unsafe Java deserialization in DefaultDeserializer. The target version 2.1.17.RELEASE contains the upstream fix (commit 462dcb6f1, AMQP-590) which introduced WhiteListDeserializingMessageConverter and deserialization class validation. However, the whitelist is empty by default per the vendor's design, requiring explicit configuration to enable protection. The fix was authored by Spring developers (Gary Russell) and shipped in the upstream release before TuxCare onboarding, making this not_affected with requires_configuration justification.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.5), Snyk (< 1.5.5).",
      "vulnerability": {
        "name": "CVE-2016-2173"
      },
      "impact_statement": "CVE-2016-2173 affects Spring AMQP versions before 1.5.5 due to unsafe Java deserialization in DefaultDeserializer. The target version 2.1.17.RELEASE contains the upstream fix (commit 462dcb6f1, AMQP-590) which introduced WhiteListDeserializingMessageConverter and deserialization class validation. However, the whitelist is empty by default per the vendor's design, requiring explicit configuration to enable protection. The fix was authored by Spring developers (Gary Russell) and shipped in the upstream release before TuxCare onboarding, making this not_affected with requires_configuration justification.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.5), Snyk (< 1.5.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.17.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.17.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2017-8045 does not affect version 2.1.17.RELEASE-tuxcare.1 of org.springframework.amqp:spring-amqp. CVE-2017-8045 affects Spring AMQP versions prior to 1.5.7, 1.6.11, and 1.7.4 due to unsafe deserialization in Message.toString(). The target version 2.1.17.RELEASE already contains the upstream fix (commit 36e55998f) that adds whitelist-based deserialization protection. The fix was authored by Pivotal/VMware and shipped in the upstream release before TuxCare onboarded it. The vulnerable pattern (unsafe ObjectInputStream.readObject() in Message.toString()) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.7; >= 1.6.0, < 1.6.11; >= 1.7.0, < 1.7.4), cve.org (< 1.7.4; = 1.6.11; = 1.5.7), Snyk (>= 1.5.6.RELEASE, < 1.5.7.RELEASE; >= 1.6.10.RELEASE, < 1.6.11.RELEASE; >= 1.7.3.RELEASE, < 1.7.4.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-8045"
      },
      "impact_statement": "CVE-2017-8045 affects Spring AMQP versions prior to 1.5.7, 1.6.11, and 1.7.4 due to unsafe deserialization in Message.toString(). The target version 2.1.17.RELEASE already contains the upstream fix (commit 36e55998f) that adds whitelist-based deserialization protection. The fix was authored by Pivotal/VMware and shipped in the upstream release before TuxCare onboarded it. The vulnerable pattern (unsafe ObjectInputStream.readObject() in Message.toString()) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.7; >= 1.6.0, < 1.6.11; >= 1.7.0, < 1.7.4), cve.org (< 1.7.4; = 1.6.11; = 1.5.7), Snyk (>= 1.5.6.RELEASE, < 1.5.7.RELEASE; >= 1.6.10.RELEASE, < 1.6.11.RELEASE; >= 1.7.3.RELEASE, < 1.7.4.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.17.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.17.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T01:27:53.972569+00:00",
      "status_notes": "Vulnerability CVE-2018-11087 does not affect version 2.1.17.RELEASE-tuxcare.1 of org.springframework.amqp:spring-amqp. not_affected \u2014 CVE-2018-11087 (lack of hostname verification enabling MITM attacks) was fixed in Spring AMQP 2.1.0.RELEASE by upstream commit 444b74e95. The target version 2.1.17.RELEASE includes this fix as part of the upstream release that TuxCare onboarded. Hostname verification is enabled by default (line 137: enableHostnameVerification = true) and properly invoked after SSL setup (lines 721-723, 815-817)...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11087"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-11087 (lack of hostname verification enabling MITM attacks) was fixed in Spring AMQP 2.1.0.RELEASE by upstream commit 444b74e95. The target version 2.1.17.RELEASE includes this fix as part of the upstream release that TuxCare onboarded. Hostname verification is enabled by default (line 137: enableHostnameVerification = true) and properly invoked after SSL setup (lines 721-723, 815-817)..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.17.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.17.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T11:22:00.124544+00:00",
      "status_notes": "Vulnerability CVE-2021-22095 is fixed in version 2.1.17.RELEASE-tuxcare.1 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2021-22095"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.17.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.17.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T11:20:55.721970+00:00",
      "status_notes": "Vulnerability CVE-2021-22097 affects version 2.1.17.RELEASE-tuxcare.1 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2021-22097"
      },
      "action_statement": "Vulnerability CVE-2021-22097 affects version 2.1.17.RELEASE-tuxcare.1 of org.springframework.amqp:spring-amqp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.17.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.17.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T11:20:55.721970+00:00",
      "status_notes": "Vulnerability CVE-2026-41701 affects version 2.1.17.RELEASE-tuxcare.1 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-41701"
      },
      "action_statement": "Vulnerability CVE-2026-41701 affects version 2.1.17.RELEASE-tuxcare.1 of org.springframework.amqp:spring-amqp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.17.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.17.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T11:20:55.721970+00:00",
      "status_notes": "Vulnerability CVE-2026-41714 affects version 2.1.17.RELEASE-tuxcare.1 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-41714"
      },
      "action_statement": "Vulnerability CVE-2026-41714 affects version 2.1.17.RELEASE-tuxcare.1 of org.springframework.amqp:spring-amqp."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.17.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.17.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T11:22:00.124544+00:00",
      "status_notes": "Vulnerability CVE-2026-47860 is fixed in version 2.1.17.RELEASE-tuxcare.1 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-47860"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.17.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.17.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T11:21:30.667671+00:00",
      "status_notes": "Vulnerability CVE-2026-59275 is fixed in version 2.1.17.RELEASE-tuxcare.1 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-59275"
      }
    }
  ]
}