{
  "@id": "urn:uuid:622b42ca-9ba9-4d63-84c4-a5fd4887f533",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T04:22:46.193289+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.6-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.6-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-10T04:22:46.193289+00:00",
      "status_notes": "Vulnerability CVE-2016-2173 does not affect version 2.4.6-tuxcare.4 of org.springframework.amqp:spring-amqp. Target version 2.4.6-tuxcare.1 is NOT affected by CVE-2016-2173. The vulnerability (unrestricted Java deserialization allowing arbitrary code execution) was fixed by upstream Spring in March 2016 (commit 462dcb6f1, AMQP-590). The fix adds AllowedListDeserializingMessageConverter with class validation during deserialization. Both SerializerMessageConverter and SimpleMessageConverter extend this class and call checkAllowedList() in their ObjectInputStream.resolveClass() overrides. The fix was already present in Spring AMQP 2.4.6 (released June 2022) when TuxCare onboarded it. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.5), Snyk (< 1.5.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-2173"
      },
      "impact_statement": "Target version 2.4.6-tuxcare.1 is NOT affected by CVE-2016-2173. The vulnerability (unrestricted Java deserialization allowing arbitrary code execution) was fixed by upstream Spring in March 2016 (commit 462dcb6f1, AMQP-590). The fix adds AllowedListDeserializingMessageConverter with class validation during deserialization. Both SerializerMessageConverter and SimpleMessageConverter extend this class and call checkAllowedList() in their ObjectInputStream.resolveClass() overrides. The fix was already present in Spring AMQP 2.4.6 (released June 2022) when TuxCare onboarded it. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.5), Snyk (< 1.5.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.6-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.6-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-10T04:22:46.193289+00:00",
      "status_notes": "Vulnerability CVE-2017-8045 does not affect version 2.4.6-tuxcare.4 of org.springframework.amqp:spring-amqp. CVE-2017-8045: The target spring-amqp version 2.4.6-tuxcare.1 is NOT AFFECTED. The vulnerable deserialization code is not present in this version. When Message.toString() encounters a serialized object (CONTENT_TYPE_SERIALIZED_OBJECT), it returns the literal string \"[serialized object]\" without performing any deserialization (Message.java:129-130). This complete elimination of deserialization in toString() was introduced by upstream Spring AMQP in version 2.4.0 (commit ed824637c by Gary Russell), superseding the earlier whitelist-based mitigation from CVE-2017-8045. TuxCare onboarded version 2.4.6 which already contained this upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.7; >= 1.6.0, < 1.6.11; >= 1.7.0, < 1.7.4), cve.org (< 1.7.4; = 1.6.11; = 1.5.7), Snyk (>= 1.5.6.RELEASE, < 1.5.7.RELEASE; >= 1.6.10.RELEASE, < 1.6.11.RELEASE; >= 1.7.3.RELEASE, < 1.7.4.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-8045"
      },
      "impact_statement": "CVE-2017-8045: The target spring-amqp version 2.4.6-tuxcare.1 is NOT AFFECTED. The vulnerable deserialization code is not present in this version. When Message.toString() encounters a serialized object (CONTENT_TYPE_SERIALIZED_OBJECT), it returns the literal string \"[serialized object]\" without performing any deserialization (Message.java:129-130). This complete elimination of deserialization in toString() was introduced by upstream Spring AMQP in version 2.4.0 (commit ed824637c by Gary Russell), superseding the earlier whitelist-based mitigation from CVE-2017-8045. TuxCare onboarded version 2.4.6 which already contained this upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.7; >= 1.6.0, < 1.6.11; >= 1.7.0, < 1.7.4), cve.org (< 1.7.4; = 1.6.11; = 1.5.7), Snyk (>= 1.5.6.RELEASE, < 1.5.7.RELEASE; >= 1.6.10.RELEASE, < 1.6.11.RELEASE; >= 1.7.3.RELEASE, < 1.7.4.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.6-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.6-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-10T04:22:46.193289+00:00",
      "status_notes": "Vulnerability CVE-2018-11087 does not affect version 2.4.6-tuxcare.4 of org.springframework.amqp:spring-amqp. not_affected \u2014 Spring AMQP 2.4.6 is not affected by CVE-2018-11087. The vulnerability affected versions prior to 2.0.6, but the target version 2.4.6 contains the upstream fix (commit 444b74e95bb299af5e23ebf006fbb45d574fb95e) that enables hostname verification by default. The fix was authored by Gary Russell from Pivotal and shipped in the upstream release that TuxCare onboarded.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11087"
      },
      "impact_statement": "not_affected \u2014 Spring AMQP 2.4.6 is not affected by CVE-2018-11087. The vulnerability affected versions prior to 2.0.6, but the target version 2.4.6 contains the upstream fix (commit 444b74e95bb299af5e23ebf006fbb45d574fb95e) that enables hostname verification by default. The fix was authored by Gary Russell from Pivotal and shipped in the upstream release that TuxCare onboarded."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.6-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.6-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-10T04:22:46.193289+00:00",
      "status_notes": "Vulnerability CVE-2021-22095 does not affect version 2.4.6-tuxcare.4 of org.springframework.amqp:spring-amqp. not_affected \u2014 CVE-2021-22095 is NOT present in Spring AMQP 2.4.6. The vulnerability (OOM error from unbounded String allocation in Message.toString()) was fixed in the upstream version 2.4.6 release before TuxCare onboarding. The fix adds a size check (body.length <= maxBodyLength, default 50 bytes) before converting message bodies to String in the toString() method. This defense is present at Message.java:1...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22095"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22095 is NOT present in Spring AMQP 2.4.6. The vulnerability (OOM error from unbounded String allocation in Message.toString()) was fixed in the upstream version 2.4.6 release before TuxCare onboarding. The fix adds a size check (body.length <= maxBodyLength, default 50 bytes) before converting message bodies to String in the toString() method. This defense is present at Message.java:1..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.6-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.6-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-10T04:22:46.193289+00:00",
      "status_notes": "Vulnerability CVE-2021-22097 does not affect version 2.4.6-tuxcare.4 of org.springframework.amqp:spring-amqp. not_affected \u2014 CVE-2021-22097 is not present in Spring AMQP 2.4.6. The vulnerability involved unsafe deserialization in the Message.toString() method for messages with content type application/x-java-serialized-object, which could cause CPU exhaustion via malicious Dictionary objects. The upstream Spring AMQP team fixed this issue in commit ed824637c (2021-09-27) by removing deserialization logic and returnin...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22097"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22097 is not present in Spring AMQP 2.4.6. The vulnerability involved unsafe deserialization in the Message.toString() method for messages with content type application/x-java-serialized-object, which could cause CPU exhaustion via malicious Dictionary objects. The upstream Spring AMQP team fixed this issue in commit ed824637c (2021-09-27) by removing deserialization logic and returnin..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.6-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.6-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-10T04:22:46.193289+00:00",
      "status_notes": "Vulnerability CVE-2026-41701 is fixed in version 2.4.6-tuxcare.4 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-41701"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.6-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.6-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-10T04:22:46.193289+00:00",
      "status_notes": "Vulnerability CVE-2026-41714 is fixed in version 2.4.6-tuxcare.4 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-41714"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.6-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.6-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-10T04:22:46.193289+00:00",
      "status_notes": "Vulnerability CVE-2026-47860 is fixed in version 2.4.6-tuxcare.4 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-47860"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.6-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.6-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-10T04:22:46.193289+00:00",
      "status_notes": "Vulnerability CVE-2026-59275 is fixed in version 2.4.6-tuxcare.4 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-59275"
      }
    }
  ]
}