{
  "@id": "urn:uuid:9f64af68-f50d-417d-99e7-844031c5141f",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:05:53.304095+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.2.12.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.2.12.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:03:00.104314+00:00",
      "status_notes": "Vulnerability CVE-2016-2173 does not affect version 2.2.12.RELEASE-tuxcare.3 of org.springframework.amqp:spring-amqp. CVE-2016-2173 affects Spring AMQP before 1.5.5 due to unsafe Java deserialization in DefaultDeserializer. The target version 2.2.12.RELEASE includes the upstream fix (commit 462dcb6f1 by Gary Russell) that introduced WhiteListDeserializingMessageConverter with class filtering via checkWhiteList(). However, the whitelist is empty by default, meaning protection requires explicit configuration. Spring considers 1.5.5+ as fixed despite requiring configuration. The fix was shipped in the upstream release, not added by TuxCare. Documentation explicitly warns users to configure whiteListPatterns when accepting messages from untrusted sources.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.5), Snyk (< 1.5.5).",
      "vulnerability": {
        "name": "CVE-2016-2173"
      },
      "impact_statement": "CVE-2016-2173 affects Spring AMQP before 1.5.5 due to unsafe Java deserialization in DefaultDeserializer. The target version 2.2.12.RELEASE includes the upstream fix (commit 462dcb6f1 by Gary Russell) that introduced WhiteListDeserializingMessageConverter with class filtering via checkWhiteList(). However, the whitelist is empty by default, meaning protection requires explicit configuration. Spring considers 1.5.5+ as fixed despite requiring configuration. The fix was shipped in the upstream release, not added by TuxCare. Documentation explicitly warns users to configure whiteListPatterns when accepting messages from untrusted sources.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.5), Snyk (< 1.5.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.2.12.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.2.12.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2017-8045 does not affect version 2.2.12.RELEASE-tuxcare.3 of org.springframework.amqp:spring-amqp. The target Spring AMQP 2.2.12.RELEASE is not vulnerable to CVE-2017-8045. The upstream release already contained the whitelist-based deserialization protection (added in versions 1.5.7/1.6.11/1.7.4) which prevents unsafe deserialization in Message.toString(). The CVE affects only versions prior to those releases. The target version 2.2.12.RELEASE is significantly newer and shipped with the fix already integrated. TuxCare later applied an even stronger fix (CVE-2021-22097) that removes deserialization entirely, but the whitelist defense was already sufficient to prevent CVE-2017-8045.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.7; >= 1.6.0, < 1.6.11; >= 1.7.0, < 1.7.4), cve.org (< 1.7.4; = 1.6.11; = 1.5.7), Snyk (>= 1.5.6.RELEASE, < 1.5.7.RELEASE; >= 1.6.10.RELEASE, < 1.6.11.RELEASE; >= 1.7.3.RELEASE, < 1.7.4.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-8045"
      },
      "impact_statement": "The target Spring AMQP 2.2.12.RELEASE is not vulnerable to CVE-2017-8045. The upstream release already contained the whitelist-based deserialization protection (added in versions 1.5.7/1.6.11/1.7.4) which prevents unsafe deserialization in Message.toString(). The CVE affects only versions prior to those releases. The target version 2.2.12.RELEASE is significantly newer and shipped with the fix already integrated. TuxCare later applied an even stronger fix (CVE-2021-22097) that removes deserialization entirely, but the whitelist defense was already sufficient to prevent CVE-2017-8045.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.7; >= 1.6.0, < 1.6.11; >= 1.7.0, < 1.7.4), cve.org (< 1.7.4; = 1.6.11; = 1.5.7), Snyk (>= 1.5.6.RELEASE, < 1.5.7.RELEASE; >= 1.6.10.RELEASE, < 1.6.11.RELEASE; >= 1.7.3.RELEASE, < 1.7.4.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.2.12.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.2.12.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:55:45.566943+00:00",
      "status_notes": "Vulnerability CVE-2018-11087 does not affect version 2.2.12.RELEASE-tuxcare.3 of org.springframework.amqp:spring-amqp. not_affected \u2014 CVE-2018-11087 (Spring AMQP hostname verification vulnerability) is NOT present in target version 2.2.12.RELEASE. The upstream vendor (Pivotal) applied the fix in commit 444b74e95bb299af5e23ebf006fbb45d574fb95e (Aug 2018), which is present in this version. Hostname verification is enabled by default (RabbitConnectionFactoryBean.java:154), and the defense is active on all SSL connection paths.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11087"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-11087 (Spring AMQP hostname verification vulnerability) is NOT present in target version 2.2.12.RELEASE. The upstream vendor (Pivotal) applied the fix in commit 444b74e95bb299af5e23ebf006fbb45d574fb95e (Aug 2018), which is present in this version. Hostname verification is enabled by default (RabbitConnectionFactoryBean.java:154), and the defense is active on all SSL connection paths."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.2.12.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.2.12.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:55:45.566943+00:00",
      "status_notes": "Vulnerability CVE-2021-22095 is fixed in version 2.2.12.RELEASE-tuxcare.3 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2021-22095"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.2.12.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.2.12.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:55:45.566943+00:00",
      "status_notes": "Vulnerability CVE-2021-22097 is fixed in version 2.2.12.RELEASE-tuxcare.3 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2021-22097"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.2.12.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.2.12.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:55:45.566943+00:00",
      "status_notes": "Vulnerability CVE-2023-34050 affects version 2.2.12.RELEASE-tuxcare.3 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2023-34050"
      },
      "action_statement": "Vulnerability CVE-2023-34050 affects version 2.2.12.RELEASE-tuxcare.3 of org.springframework.amqp:spring-amqp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.2.12.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.2.12.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:55:45.566943+00:00",
      "status_notes": "Vulnerability CVE-2026-41701 affects version 2.2.12.RELEASE-tuxcare.3 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-41701"
      },
      "action_statement": "Vulnerability CVE-2026-41701 affects version 2.2.12.RELEASE-tuxcare.3 of org.springframework.amqp:spring-amqp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.2.12.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.2.12.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:55:45.566943+00:00",
      "status_notes": "Vulnerability CVE-2026-41714 affects version 2.2.12.RELEASE-tuxcare.3 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-41714"
      },
      "action_statement": "Vulnerability CVE-2026-41714 affects version 2.2.12.RELEASE-tuxcare.3 of org.springframework.amqp:spring-amqp."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.2.12.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.2.12.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:55:45.566943+00:00",
      "status_notes": "Vulnerability CVE-2026-47860 is fixed in version 2.2.12.RELEASE-tuxcare.3 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-47860"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.2.12.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.2.12.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T15:55:45.566943+00:00",
      "status_notes": "Vulnerability CVE-2026-59275 is fixed in version 2.2.12.RELEASE-tuxcare.3 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-59275"
      }
    }
  ]
}