{
  "@id": "urn:uuid:6bf2c8e2-f201-4c24-8de1-1358b2abe0de",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 6,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T13:37:10.593552+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.2.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.2.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T12:09:00.012843+00:00",
      "status_notes": "Vulnerability CVE-2016-2173 does not affect version 2.1.2.RELEASE-tuxcare.1 of org.springframework.amqp:spring-amqp. The target repository (Spring AMQP 2.1.2.RELEASE) is not affected by CVE-2016-2173. The vulnerability, which allowed arbitrary code execution through unsafe Java deserialization in message converters, was fixed in upstream Spring AMQP 1.5.5 (March 2016). The fix introduced class whitelisting during deserialization by creating WhiteListDeserializingMessageConverter and modifying SerializerMessageConverter and SimpleMessageConverter to validate classes before deserialization. This fix was already present in the upstream 2.1.2.RELEASE that TuxCare onboarded (commit dfdecb62b), having been introduced in commit 462dcb6f1 by Gary Russell from Pivotal/VMware. No TuxCare backport was required.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-2173"
      },
      "impact_statement": "The target repository (Spring AMQP 2.1.2.RELEASE) is not affected by CVE-2016-2173. The vulnerability, which allowed arbitrary code execution through unsafe Java deserialization in message converters, was fixed in upstream Spring AMQP 1.5.5 (March 2016). The fix introduced class whitelisting during deserialization by creating WhiteListDeserializingMessageConverter and modifying SerializerMessageConverter and SimpleMessageConverter to validate classes before deserialization. This fix was already present in the upstream 2.1.2.RELEASE that TuxCare onboarded (commit dfdecb62b), having been introduced in commit 462dcb6f1 by Gary Russell from Pivotal/VMware. No TuxCare backport was required."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.2.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.2.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T12:46:45.968557+00:00",
      "status_notes": "Vulnerability CVE-2017-8045 does not affect version 2.1.2.RELEASE-tuxcare.1 of org.springframework.amqp:spring-amqp. CVE-2017-8045 affects Spring AMQP before 1.5.7, 1.6.0\u20131.6.10 and 1.7.0\u20131.7.3 (Spring advisory, NVD); it is fixed upstream in 1.5.7, 1.6.11 and 1.7.4. Version 2.1.2.RELEASE is later than every fixed release and already contains the upstream fix, so the unsafe deserialization in Message.toString() is not present.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-8045"
      },
      "impact_statement": "CVE-2017-8045 affects Spring AMQP before 1.5.7, 1.6.0\u20131.6.10 and 1.7.0\u20131.7.3 (Spring advisory, NVD); it is fixed upstream in 1.5.7, 1.6.11 and 1.7.4. Version 2.1.2.RELEASE is later than every fixed release and already contains the upstream fix, so the unsafe deserialization in Message.toString() is not present."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.2.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.2.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T11:35:00.106639+00:00",
      "status_notes": "Vulnerability CVE-2018-11087 does not affect version 2.1.2.RELEASE-tuxcare.1 of org.springframework.amqp:spring-amqp. not_affected \u2014 Spring AMQP 2.1.2.RELEASE is not affected by CVE-2018-11087. The vulnerability (lack of hostname verification in TLS connections) was fixed in upstream version 2.0.6, and version 2.1.2.RELEASE already includes this fix. The `enableHostnameVerification` flag is set to `true` by default (line 137 of RabbitConnectionFactoryBean.java), and hostname verification is properly invoked during SSL setup ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11087"
      },
      "impact_statement": "not_affected \u2014 Spring AMQP 2.1.2.RELEASE is not affected by CVE-2018-11087. The vulnerability (lack of hostname verification in TLS connections) was fixed in upstream version 2.0.6, and version 2.1.2.RELEASE already includes this fix. The `enableHostnameVerification` flag is set to `true` by default (line 137 of RabbitConnectionFactoryBean.java), and hostname verification is properly invoked during SSL setup ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.2.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.2.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T13:37:10.593552+00:00",
      "status_notes": "Vulnerability CVE-2021-22095 affects version 2.1.2.RELEASE-tuxcare.1 of org.springframework.amqp:spring-amqp, and is fixed in 2.1.2.RELEASE-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2021-22095"
      },
      "action_statement": "Vulnerability CVE-2021-22095 affects version 2.1.2.RELEASE-tuxcare.1 of org.springframework.amqp:spring-amqp, and is fixed in 2.1.2.RELEASE-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.2.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.2.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T13:37:00.156697+00:00",
      "status_notes": "Vulnerability CVE-2021-22097 affects version 2.1.2.RELEASE-tuxcare.1 of org.springframework.amqp:spring-amqp, and is fixed in 2.1.2.RELEASE-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2021-22097"
      },
      "action_statement": "Vulnerability CVE-2021-22097 affects version 2.1.2.RELEASE-tuxcare.1 of org.springframework.amqp:spring-amqp, and is fixed in 2.1.2.RELEASE-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.2.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.2.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T13:37:00.156697+00:00",
      "status_notes": "Vulnerability CVE-2026-41701 affects version 2.1.2.RELEASE-tuxcare.1 of org.springframework.amqp:spring-amqp, and is fixed in 2.1.2.RELEASE-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-41701"
      },
      "action_statement": "Vulnerability CVE-2026-41701 affects version 2.1.2.RELEASE-tuxcare.1 of org.springframework.amqp:spring-amqp, and is fixed in 2.1.2.RELEASE-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.2.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.2.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T13:37:00.156697+00:00",
      "status_notes": "Vulnerability CVE-2026-41714 affects version 2.1.2.RELEASE-tuxcare.1 of org.springframework.amqp:spring-amqp, and is fixed in 2.1.2.RELEASE-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-41714"
      },
      "action_statement": "Vulnerability CVE-2026-41714 affects version 2.1.2.RELEASE-tuxcare.1 of org.springframework.amqp:spring-amqp, and is fixed in 2.1.2.RELEASE-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.2.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.2.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T13:37:00.156697+00:00",
      "status_notes": "Vulnerability CVE-2026-47860 affects version 2.1.2.RELEASE-tuxcare.1 of org.springframework.amqp:spring-amqp, and is fixed in 2.1.2.RELEASE-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-47860"
      },
      "action_statement": "Vulnerability CVE-2026-47860 affects version 2.1.2.RELEASE-tuxcare.1 of org.springframework.amqp:spring-amqp, and is fixed in 2.1.2.RELEASE-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.2.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.2.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T13:37:00.156697+00:00",
      "status_notes": "Vulnerability CVE-2026-59275 affects version 2.1.2.RELEASE-tuxcare.1 of org.springframework.amqp:spring-amqp, and is fixed in 2.1.2.RELEASE-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-59275"
      },
      "action_statement": "Vulnerability CVE-2026-59275 affects version 2.1.2.RELEASE-tuxcare.1 of org.springframework.amqp:spring-amqp, and is fixed in 2.1.2.RELEASE-tuxcare.2."
    }
  ]
}