{
  "@id": "urn:uuid:77317dbe-7657-4244-bae9-d4e3e7806772",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-12T11:44:51.566670+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.2.9.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.2.9.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:44:51.566670+00:00",
      "status_notes": "Vulnerability CVE-2016-2173 does not affect version 2.2.9.RELEASE-tuxcare.3 of org.springframework.amqp:spring-amqp. Spring AMQP 2.2.9.RELEASE is not affected by CVE-2016-2173. The upstream vendor (Spring) introduced whitelist-based deserialization protection in version 1.5.5 (March 2016) via commit 462dcb6f by Gary Russell. This defense mechanism is present in version 2.2.9.RELEASE but requires explicit configuration to be effective. The whitelist is empty by default, which allows all classes to be deserialized, but the vendor considers versions >= 1.5.5 to be fixed because they provide the mitigation mechanism. Documentation warns users to configure whiteListPatterns when accepting untrusted serialized objects. The fix was authored by the upstream Spring team and shipped in the 2.2.9.RELEASE that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.5), Snyk (< 1.5.5).",
      "vulnerability": {
        "name": "CVE-2016-2173"
      },
      "impact_statement": "Spring AMQP 2.2.9.RELEASE is not affected by CVE-2016-2173. The upstream vendor (Spring) introduced whitelist-based deserialization protection in version 1.5.5 (March 2016) via commit 462dcb6f by Gary Russell. This defense mechanism is present in version 2.2.9.RELEASE but requires explicit configuration to be effective. The whitelist is empty by default, which allows all classes to be deserialized, but the vendor considers versions >= 1.5.5 to be fixed because they provide the mitigation mechanism. Documentation warns users to configure whiteListPatterns when accepting untrusted serialized objects. The fix was authored by the upstream Spring team and shipped in the 2.2.9.RELEASE that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.5), Snyk (< 1.5.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.2.9.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.2.9.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:44:51.566670+00:00",
      "status_notes": "Vulnerability CVE-2017-8045 does not affect version 2.2.9.RELEASE-tuxcare.3 of org.springframework.amqp:spring-amqp. CVE-2017-8045 describes unsafe Java deserialization in Spring AMQP's Message.toString() method that could enable remote code execution. The vulnerability affected versions prior to 1.5.7, 1.6.11, and 1.7.4 (released September 2017). The target version 2.2.9.RELEASE (released July 2020) is not affected because the fix was already present in the upstream release. The fix (commit 36e55998f by Gary Russell, September 2017) replaced unsafe SerializationUtils.deserialize() calls with whitelist-based deserialization, defaulting to only java.util.* and java.lang.* packages. All production deserialization paths in the current codebase use whitelist protection, preventing arbitrary code execution through malicious serialized objects.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.7; >= 1.6.0, < 1.6.11; >= 1.7.0, < 1.7.4), cve.org (< 1.7.4; = 1.6.11; = 1.5.7), Snyk (>= 1.5.6.RELEASE, < 1.5.7.RELEASE; >= 1.6.10.RELEASE, < 1.6.11.RELEASE; >= 1.7.3.RELEASE, < 1.7.4.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-8045"
      },
      "impact_statement": "CVE-2017-8045 describes unsafe Java deserialization in Spring AMQP's Message.toString() method that could enable remote code execution. The vulnerability affected versions prior to 1.5.7, 1.6.11, and 1.7.4 (released September 2017). The target version 2.2.9.RELEASE (released July 2020) is not affected because the fix was already present in the upstream release. The fix (commit 36e55998f by Gary Russell, September 2017) replaced unsafe SerializationUtils.deserialize() calls with whitelist-based deserialization, defaulting to only java.util.* and java.lang.* packages. All production deserialization paths in the current codebase use whitelist protection, preventing arbitrary code execution through malicious serialized objects.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.7; >= 1.6.0, < 1.6.11; >= 1.7.0, < 1.7.4), cve.org (< 1.7.4; = 1.6.11; = 1.5.7), Snyk (>= 1.5.6.RELEASE, < 1.5.7.RELEASE; >= 1.6.10.RELEASE, < 1.6.11.RELEASE; >= 1.7.3.RELEASE, < 1.7.4.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.2.9.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.2.9.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:44:51.566670+00:00",
      "status_notes": "Vulnerability CVE-2018-11087 does not affect version 2.2.9.RELEASE-tuxcare.3 of org.springframework.amqp:spring-amqp. not_affected \u2014 CVE-2018-11087 affects Spring AMQP versions prior to 1.7.10 (1.x) and 2.0.6 (2.x) due to missing hostname verification in TLS connections. The target version 2.2.9.RELEASE already contains the upstream fix (commit 444b74e95) which enables hostname verification by default. The vulnerable pattern is not present because the fix was shipped in the upstream release before TuxCare onboarded this vers...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11087"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-11087 affects Spring AMQP versions prior to 1.7.10 (1.x) and 2.0.6 (2.x) due to missing hostname verification in TLS connections. The target version 2.2.9.RELEASE already contains the upstream fix (commit 444b74e95) which enables hostname verification by default. The vulnerable pattern is not present because the fix was shipped in the upstream release before TuxCare onboarded this vers..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.2.9.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.2.9.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:44:51.566670+00:00",
      "status_notes": "Vulnerability CVE-2021-22095 is fixed in version 2.2.9.RELEASE-tuxcare.3 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2021-22095"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.2.9.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.2.9.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:44:51.566670+00:00",
      "status_notes": "Vulnerability CVE-2021-22097 is fixed in version 2.2.9.RELEASE-tuxcare.3 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2021-22097"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.2.9.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.2.9.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:44:51.566670+00:00",
      "status_notes": "Vulnerability CVE-2026-41701 is fixed in version 2.2.9.RELEASE-tuxcare.3 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-41701"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.2.9.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.2.9.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:44:51.566670+00:00",
      "status_notes": "Vulnerability CVE-2026-41714 is fixed in version 2.2.9.RELEASE-tuxcare.3 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-41714"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.2.9.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.2.9.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:44:51.566670+00:00",
      "status_notes": "Vulnerability CVE-2026-47860 is fixed in version 2.2.9.RELEASE-tuxcare.3 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-47860"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.2.9.RELEASE-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.2.9.RELEASE-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-12T11:44:51.566670+00:00",
      "status_notes": "Vulnerability CVE-2026-59275 does not affect version 2.2.9.RELEASE-tuxcare.3 of org.springframework.amqp:spring-amqp. not_affected \u2014 CVE-2026-59275 requires JavaLangErrorHandler with System.exit(99) to terminate the JVM when deserialization errors occur. This feature was introduced in October 2020, three months AFTER version 2.2.9.RELEASE (July 2020). In 2.2.9, errors during message processing are caught by SimpleMessageListenerContainer and only abort the listener thread, not the entire JVM. While the SerializationUtils arr...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-59275"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-59275 requires JavaLangErrorHandler with System.exit(99) to terminate the JVM when deserialization errors occur. This feature was introduced in October 2020, three months AFTER version 2.2.9.RELEASE (July 2020). In 2.2.9, errors during message processing are caught by SimpleMessageListenerContainer and only abort the listener thread, not the entire JVM. While the SerializationUtils arr..."
    }
  ]
}