{
  "@id": "urn:uuid:8e7c2d7b-5fb5-42f5-a73c-04493c8f2386",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 9,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:04:11.456857+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.17-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.17-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:01:00.133094+00:00",
      "status_notes": "Vulnerability CVE-2016-2173 does not affect version 2.4.17-tuxcare.3 of org.springframework.amqp:spring-amqp. CVE-2016-2173 affects Spring AMQP versions before 1.5.5 due to unrestricted Java deserialization via DefaultDeserializer. The target version 2.4.17-tuxcare.11 is NOT vulnerable because it includes the upstream fix introduced in Spring AMQP 1.5.5 (June 2020, commit ee52539c1). The fix adds AllowedListDeserializingMessageConverter which validates classes via checkAllowedList() before deserialization. By default, only primitives, Numbers, and Strings are allowed; all other classes throw SecurityException unless explicitly allowlisted. This defense is on the critical path in ObjectInputStream.resolveClass() and cannot be bypassed. The fix was authored by Gary Russell (upstream Spring developer), shipped in the upstream 2.4.17 release, and inherited when TuxCare onboarded that version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.5), Snyk (< 1.5.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-2173"
      },
      "impact_statement": "CVE-2016-2173 affects Spring AMQP versions before 1.5.5 due to unrestricted Java deserialization via DefaultDeserializer. The target version 2.4.17-tuxcare.11 is NOT vulnerable because it includes the upstream fix introduced in Spring AMQP 1.5.5 (June 2020, commit ee52539c1). The fix adds AllowedListDeserializingMessageConverter which validates classes via checkAllowedList() before deserialization. By default, only primitives, Numbers, and Strings are allowed; all other classes throw SecurityException unless explicitly allowlisted. This defense is on the critical path in ObjectInputStream.resolveClass() and cannot be bypassed. The fix was authored by Gary Russell (upstream Spring developer), shipped in the upstream 2.4.17 release, and inherited when TuxCare onboarded that version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.5), Snyk (< 1.5.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.17-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.17-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:04:11.456857+00:00",
      "status_notes": "Vulnerability CVE-2017-8045 does not affect version 2.4.17-tuxcare.3 of org.springframework.amqp:spring-amqp. CVE-2017-8045 describes unsafe deserialization in Spring AMQP's Message.toString() method that could enable remote code execution. The target repository (Spring AMQP version 2.4.17-tuxcare.11) is NOT AFFECTED because the upstream vendor fix was already present in the v2.4.17 release that TuxCare onboarded. The fix (commit ed824637c by Gary Russell) removed the vulnerable SerializationUtils.deserialize() call and replaced it with a safe string literal \"[serialized object]\", eliminating the deserialization vulnerability entirely.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.7; >= 1.6.0, < 1.6.11; >= 1.7.0, < 1.7.4), cve.org (< 1.7.4; = 1.6.11; = 1.5.7), Snyk (>= 1.5.6.RELEASE, < 1.5.7.RELEASE; >= 1.6.10.RELEASE, < 1.6.11.RELEASE; >= 1.7.3.RELEASE, < 1.7.4.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-8045"
      },
      "impact_statement": "CVE-2017-8045 describes unsafe deserialization in Spring AMQP's Message.toString() method that could enable remote code execution. The target repository (Spring AMQP version 2.4.17-tuxcare.11) is NOT AFFECTED because the upstream vendor fix was already present in the v2.4.17 release that TuxCare onboarded. The fix (commit ed824637c by Gary Russell) removed the vulnerable SerializationUtils.deserialize() call and replaced it with a safe string literal \"[serialized object]\", eliminating the deserialization vulnerability entirely.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.7; >= 1.6.0, < 1.6.11; >= 1.7.0, < 1.7.4), cve.org (< 1.7.4; = 1.6.11; = 1.5.7), Snyk (>= 1.5.6.RELEASE, < 1.5.7.RELEASE; >= 1.6.10.RELEASE, < 1.6.11.RELEASE; >= 1.7.3.RELEASE, < 1.7.4.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.17-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.17-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2018-11087 does not affect version 2.4.17-tuxcare.3 of org.springframework.amqp:spring-amqp. not_affected \u2014 The target Spring AMQP 2.4.17-tuxcare.4 is not affected by CVE-2018-11087 (lack of hostname verification in TLS connections). The upstream vendor (Spring/Pivotal) applied the fix in version 2.1.0.M3 (commit 444b74e9), making hostname verification enabled by default. The target's base version 2.4.17 already contains this upstream fix. The vulnerable pattern (missing hostname verification) is not...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11087"
      },
      "impact_statement": "not_affected \u2014 The target Spring AMQP 2.4.17-tuxcare.4 is not affected by CVE-2018-11087 (lack of hostname verification in TLS connections). The upstream vendor (Spring/Pivotal) applied the fix in version 2.1.0.M3 (commit 444b74e9), making hostname verification enabled by default. The target's base version 2.4.17 already contains this upstream fix. The vulnerable pattern (missing hostname verification) is not..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.17-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.17-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T05:01:00.106690+00:00",
      "status_notes": "Vulnerability CVE-2021-22095 does not affect version 2.4.17-tuxcare.3 of org.springframework.amqp:spring-amqp. not_affected \u2014 CVE-2021-22095 affects Spring AMQP versions 2.2.0-2.2.19 and 2.3.0-2.3.11 due to unbounded string conversion of message bodies in Message.toString(), causing potential OOM errors. The target version 2.4.17 is not affected because the fix was already present in the upstream Spring AMQP 2.4.17 release when TuxCare onboarded it. The fix (commit 4f3a1539d by Gary Russell) adds a maxBodyLength check...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22095"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22095 affects Spring AMQP versions 2.2.0-2.2.19 and 2.3.0-2.3.11 due to unbounded string conversion of message bodies in Message.toString(), causing potential OOM errors. The target version 2.4.17 is not affected because the fix was already present in the upstream Spring AMQP 2.4.17 release when TuxCare onboarded it. The fix (commit 4f3a1539d by Gary Russell) adds a maxBodyLength check..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.17-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.17-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T05:04:00.209412+00:00",
      "status_notes": "Vulnerability CVE-2021-22097 does not affect version 2.4.17-tuxcare.3 of org.springframework.amqp:spring-amqp. not_affected \u2014 CVE-2021-22097: The target Spring AMQP 2.4.17-tuxcare.10 is not affected. The vulnerability (Message.toString() deserializing serialized objects, enabling DoS via malicious java.util.Dictionary) was fixed by the upstream Spring team in September 2021. The fix was already present in Spring AMQP v2.4.17 (released October 2023) when TuxCare onboarded it. Message.toString() now returns \"[serialized...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22097"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22097: The target Spring AMQP 2.4.17-tuxcare.10 is not affected. The vulnerability (Message.toString() deserializing serialized objects, enabling DoS via malicious java.util.Dictionary) was fixed by the upstream Spring team in September 2021. The fix was already present in Spring AMQP v2.4.17 (released October 2023) when TuxCare onboarded it. Message.toString() now returns \"[serialized..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.17-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.17-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41701 affects version 2.4.17-tuxcare.3 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-41701"
      },
      "action_statement": "Vulnerability CVE-2026-41701 affects version 2.4.17-tuxcare.3 of org.springframework.amqp:spring-amqp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.17-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.17-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41714 affects version 2.4.17-tuxcare.3 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-41714"
      },
      "action_statement": "Vulnerability CVE-2026-41714 affects version 2.4.17-tuxcare.3 of org.springframework.amqp:spring-amqp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.17-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.17-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-15T13:47:00.280428+00:00",
      "status_notes": "Vulnerability CVE-2026-47860 affects version 2.4.17-tuxcare.3 of org.springframework.amqp:spring-amqp, and is fixed in 2.4.17-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2026-47860"
      },
      "action_statement": "Vulnerability CVE-2026-47860 affects version 2.4.17-tuxcare.3 of org.springframework.amqp:spring-amqp, and is fixed in 2.4.17-tuxcare.9."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.17-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.17-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-15T13:47:00.280428+00:00",
      "status_notes": "Vulnerability CVE-2026-59275 affects version 2.4.17-tuxcare.3 of org.springframework.amqp:spring-amqp, and is fixed in 2.4.17-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2026-59275"
      },
      "action_statement": "Vulnerability CVE-2026-59275 affects version 2.4.17-tuxcare.3 of org.springframework.amqp:spring-amqp, and is fixed in 2.4.17-tuxcare.9."
    }
  ]
}