{
  "@id": "urn:uuid:7dfe1239-6dbd-4eb8-9f36-23b5e7597391",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 9,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:07:59.808671+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2016-2173 does not affect version 2.4.4-tuxcare.2 of org.springframework.amqp:spring-amqp. CVE-2016-2173 affects Spring AMQP versions before 1.5.5 due to unfiltered Java deserialization in DefaultDeserializer, allowing remote code execution via gadget chains. The target version 2.4.4-tuxcare.2 is NOT vulnerable. The fix (commit 462dcb6f, AMQP-590) was introduced by the Spring team on 2016-03-15, included in Spring AMQP 1.5.5, and was already present in the upstream 2.4.4 release before TuxCare onboarded it. The fix added AllowedListDeserializingMessageConverter with class validation via allowed-list patterns, preventing arbitrary class deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.5), Snyk (< 1.5.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-2173"
      },
      "impact_statement": "CVE-2016-2173 affects Spring AMQP versions before 1.5.5 due to unfiltered Java deserialization in DefaultDeserializer, allowing remote code execution via gadget chains. The target version 2.4.4-tuxcare.2 is NOT vulnerable. The fix (commit 462dcb6f, AMQP-590) was introduced by the Spring team on 2016-03-15, included in Spring AMQP 1.5.5, and was already present in the upstream 2.4.4 release before TuxCare onboarded it. The fix added AllowedListDeserializingMessageConverter with class validation via allowed-list patterns, preventing arbitrary class deserialization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.5), Snyk (< 1.5.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:07:59.808671+00:00",
      "status_notes": "Vulnerability CVE-2017-8045 does not affect version 2.4.4-tuxcare.2 of org.springframework.amqp:spring-amqp. CVE-2017-8045 affects Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7, where Message.toString() performed unsafe deserialization of serialized Java objects, enabling remote code execution. The target version 2.4.4-tuxcare.2 contains the upstream fix that was already present in the Spring AMQP 2.4.4 release. The vulnerable pattern is not present: when a Message contains a serialized object (contentType == CONTENT_TYPE_SERIALIZED_OBJECT), the toString() method returns the literal string \"[serialized object]\" without deserializing the payload (Message.java:129-130). The fix was authored by Gary Russell (VMware) in commits 36e55998f (2017, initial whitelist-based fix) and ed824637c (2021, complete removal of deserialization), both of which shipped in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.7; >= 1.6.0, < 1.6.11; >= 1.7.0, < 1.7.4), cve.org (< 1.7.4; = 1.6.11; = 1.5.7), Snyk (>= 1.5.6.RELEASE, < 1.5.7.RELEASE; >= 1.6.10.RELEASE, < 1.6.11.RELEASE; >= 1.7.3.RELEASE, < 1.7.4.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-8045"
      },
      "impact_statement": "CVE-2017-8045 affects Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7, where Message.toString() performed unsafe deserialization of serialized Java objects, enabling remote code execution. The target version 2.4.4-tuxcare.2 contains the upstream fix that was already present in the Spring AMQP 2.4.4 release. The vulnerable pattern is not present: when a Message contains a serialized object (contentType == CONTENT_TYPE_SERIALIZED_OBJECT), the toString() method returns the literal string \"[serialized object]\" without deserializing the payload (Message.java:129-130). The fix was authored by Gary Russell (VMware) in commits 36e55998f (2017, initial whitelist-based fix) and ed824637c (2021, complete removal of deserialization), both of which shipped in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.7; >= 1.6.0, < 1.6.11; >= 1.7.0, < 1.7.4), cve.org (< 1.7.4; = 1.6.11; = 1.5.7), Snyk (>= 1.5.6.RELEASE, < 1.5.7.RELEASE; >= 1.6.10.RELEASE, < 1.6.11.RELEASE; >= 1.7.3.RELEASE, < 1.7.4.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T01:27:53.972569+00:00",
      "status_notes": "Vulnerability CVE-2018-11087 does not affect version 2.4.4-tuxcare.2 of org.springframework.amqp:spring-amqp. not_affected \u2014 The target Spring AMQP 2.4.4-tuxcare.2 is NOT affected by CVE-2018-11087. The vulnerability (lack of hostname verification in TLS connections) is not present because the upstream Spring AMQP 2.4.4 release already included the fix. The RabbitConnectionFactoryBean enables hostname verification by default (enableHostnameVerification = true at line 158) and calls ConnectionFactory.enableHostnameVer...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11087"
      },
      "impact_statement": "not_affected \u2014 The target Spring AMQP 2.4.4-tuxcare.2 is NOT affected by CVE-2018-11087. The vulnerability (lack of hostname verification in TLS connections) is not present because the upstream Spring AMQP 2.4.4 release already included the fix. The RabbitConnectionFactoryBean enables hostname verification by default (enableHostnameVerification = true at line 158) and calls ConnectionFactory.enableHostnameVer..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T05:01:45.788222+00:00",
      "status_notes": "Vulnerability CVE-2021-22095 does not affect version 2.4.4-tuxcare.2 of org.springframework.amqp:spring-amqp. not_affected \u2014 CVE-2021-22095 does not affect Spring AMQP 2.4.4. The vulnerability (toString() converting large message bodies to String without size limits, causing potential OOM errors) was fixed in the upstream 2.4.x release line before TuxCare onboarded version 2.4.4. The fix commit 4f3a1539d by Gary Russell (grussell@vmware.com) added a configurable size limit (default 50 bytes) to prevent unbounded stri...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22095"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22095 does not affect Spring AMQP 2.4.4. The vulnerability (toString() converting large message bodies to String without size limits, causing potential OOM errors) was fixed in the upstream 2.4.x release line before TuxCare onboarded version 2.4.4. The fix commit 4f3a1539d by Gary Russell (grussell@vmware.com) added a configurable size limit (default 50 bytes) to prevent unbounded stri..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T05:06:34.251132+00:00",
      "status_notes": "Vulnerability CVE-2021-22097 does not affect version 2.4.4-tuxcare.2 of org.springframework.amqp:spring-amqp. not_affected \u2014 CVE-2021-22097 is not present in spring-amqp 2.4.4-tuxcare.2. The vulnerability (deserialization in Message.toString() causing CPU exhaustion) was fixed in upstream commit ed824637c (2021-09-27) before the upstream 2.4.4 release (2022-04-18). TuxCare onboarded the already-fixed upstream version. The target code at Message.java:129-130 returns \"[serialized object]\" instead of deserializing, prev...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22097"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22097 is not present in spring-amqp 2.4.4-tuxcare.2. The vulnerability (deserialization in Message.toString() causing CPU exhaustion) was fixed in upstream commit ed824637c (2021-09-27) before the upstream 2.4.4 release (2022-04-18). TuxCare onboarded the already-fixed upstream version. The target code at Message.java:129-130 returns \"[serialized object]\" instead of deserializing, prev..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-23T08:45:34.249175+00:00",
      "status_notes": "Vulnerability CVE-2026-41701 affects version 2.4.4-tuxcare.2 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-41701"
      },
      "action_statement": "Vulnerability CVE-2026-41701 affects version 2.4.4-tuxcare.2 of org.springframework.amqp:spring-amqp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-23T08:45:34.249175+00:00",
      "status_notes": "Vulnerability CVE-2026-41714 affects version 2.4.4-tuxcare.2 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-41714"
      },
      "action_statement": "Vulnerability CVE-2026-41714 affects version 2.4.4-tuxcare.2 of org.springframework.amqp:spring-amqp."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-23T08:45:34.249175+00:00",
      "status_notes": "Vulnerability CVE-2026-47860 is fixed in version 2.4.4-tuxcare.2 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-47860"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-23T08:45:34.249175+00:00",
      "status_notes": "Vulnerability CVE-2026-59275 is fixed in version 2.4.4-tuxcare.2 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-59275"
      }
    }
  ]
}