{
  "@id": "urn:uuid:f63ab622-f947-4469-a76d-fc637b5a807e",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 9,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:04:11.456857+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.0.10-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.0.10-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:03:00.104314+00:00",
      "status_notes": "Vulnerability CVE-2016-2173 does not affect version 3.0.10-tuxcare.3 of org.springframework.amqp:spring-amqp. CVE-2016-2173 affects Spring AMQP before version 1.5.5, where unrestricted Java deserialization via DefaultDeserializer allows remote code execution. The target (Spring AMQP 3.0.10-tuxcare.3) contains the upstream fix introduced in commit 462dcb6f1 (March 2016) by Gary Russell, which added the AllowedListDeserializingMessageConverter class (originally WhiteListDeserializingMessageConverter). This defense validates all classes against configurable patterns before deserialization and throws SecurityException for unauthorized classes. The fix was already present in the upstream 3.0.10 release that TuxCare onboarded, making this version not affected by the vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.5), Snyk (< 1.5.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-2173"
      },
      "impact_statement": "CVE-2016-2173 affects Spring AMQP before version 1.5.5, where unrestricted Java deserialization via DefaultDeserializer allows remote code execution. The target (Spring AMQP 3.0.10-tuxcare.3) contains the upstream fix introduced in commit 462dcb6f1 (March 2016) by Gary Russell, which added the AllowedListDeserializingMessageConverter class (originally WhiteListDeserializingMessageConverter). This defense validates all classes against configurable patterns before deserialization and throws SecurityException for unauthorized classes. The fix was already present in the upstream 3.0.10 release that TuxCare onboarded, making this version not affected by the vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.5), Snyk (< 1.5.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.0.10-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.0.10-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:04:11.456857+00:00",
      "status_notes": "Vulnerability CVE-2017-8045 does not affect version 3.0.10-tuxcare.3 of org.springframework.amqp:spring-amqp. CVE-2017-8045 affects Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7 due to unsafe deserialization in Message.toString(). The target version 3.0.10-tuxcare.3 is NOT AFFECTED because the vulnerable deserialization code pattern is not present. The fix was applied upstream by Gary Russell (VMware) in commit ed824637c on 2021-09-27, which completely removed deserialization from the toString() method. This fix (along with an earlier 2017 whitelist-based fix in commit 36e55998f) was already present in upstream version 3.0.10 when TuxCare onboarded it. The current code at Message.java:119-120 returns \"[serialized object]\" instead of deserializing, preventing the RCE attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.7; >= 1.6.0, < 1.6.11; >= 1.7.0, < 1.7.4), cve.org (< 1.7.4; = 1.6.11; = 1.5.7), Snyk (>= 1.5.6.RELEASE, < 1.5.7.RELEASE; >= 1.6.10.RELEASE, < 1.6.11.RELEASE; >= 1.7.3.RELEASE, < 1.7.4.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-8045"
      },
      "impact_statement": "CVE-2017-8045 affects Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7 due to unsafe deserialization in Message.toString(). The target version 3.0.10-tuxcare.3 is NOT AFFECTED because the vulnerable deserialization code pattern is not present. The fix was applied upstream by Gary Russell (VMware) in commit ed824637c on 2021-09-27, which completely removed deserialization from the toString() method. This fix (along with an earlier 2017 whitelist-based fix in commit 36e55998f) was already present in upstream version 3.0.10 when TuxCare onboarded it. The current code at Message.java:119-120 returns \"[serialized object]\" instead of deserializing, preventing the RCE attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.7; >= 1.6.0, < 1.6.11; >= 1.7.0, < 1.7.4), cve.org (< 1.7.4; = 1.6.11; = 1.5.7), Snyk (>= 1.5.6.RELEASE, < 1.5.7.RELEASE; >= 1.6.10.RELEASE, < 1.6.11.RELEASE; >= 1.7.3.RELEASE, < 1.7.4.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.0.10-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.0.10-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-15T13:42:00.561622+00:00",
      "status_notes": "Vulnerability CVE-2018-11087 does not affect version 3.0.10-tuxcare.3 of org.springframework.amqp:spring-amqp. The upstream baseline already contains the fix.",
      "vulnerability": {
        "name": "CVE-2018-11087"
      },
      "impact_statement": "The upstream baseline already contains the fix."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.0.10-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.0.10-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T05:02:00.518069+00:00",
      "status_notes": "Vulnerability CVE-2021-22095 does not affect version 3.0.10-tuxcare.3 of org.springframework.amqp:spring-amqp. not_affected \u2014 CVE-2021-22095 fix was already present in upstream Spring AMQP 3.0.10 when TuxCare onboarded it. The vulnerability affects versions 2.2.0-2.2.19 and 2.3.0-2.3.11. The fix (limiting toString() body length to prevent OOM) was introduced in upstream versions 2.2.20, 2.3.12, and all later releases including 3.0.10. The fix commit (4f3a1539d) by Gary Russell (grussell@vmware.com) is an ancestor of b...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22095"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22095 fix was already present in upstream Spring AMQP 3.0.10 when TuxCare onboarded it. The vulnerability affects versions 2.2.0-2.2.19 and 2.3.0-2.3.11. The fix (limiting toString() body length to prevent OOM) was introduced in upstream versions 2.2.20, 2.3.12, and all later releases including 3.0.10. The fix commit (4f3a1539d) by Gary Russell (grussell@vmware.com) is an ancestor of b..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.0.10-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.0.10-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T05:05:00.060068+00:00",
      "status_notes": "Vulnerability CVE-2021-22097 does not affect version 3.0.10-tuxcare.3 of org.springframework.amqp:spring-amqp. not_affected \u2014 Spring AMQP 3.0.10 is not affected by CVE-2021-22097. The vulnerability (deserialization in Message.toString() causing CPU exhaustion) was fixed by upstream Spring maintainer Gary Russell in commit ed824637c on 2021-09-27, over two years before version 3.0.10 was released (2023-10-16). The fix was already present in the upstream release when TuxCare onboarded it. The vulnerable code path that c...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22097"
      },
      "impact_statement": "not_affected \u2014 Spring AMQP 3.0.10 is not affected by CVE-2021-22097. The vulnerability (deserialization in Message.toString() causing CPU exhaustion) was fixed by upstream Spring maintainer Gary Russell in commit ed824637c on 2021-09-27, over two years before version 3.0.10 was released (2023-10-16). The fix was already present in the upstream release when TuxCare onboarded it. The vulnerable code path that c..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.0.10-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.0.10-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-15T13:42:00.561622+00:00",
      "status_notes": "Vulnerability CVE-2026-41701 affects version 3.0.10-tuxcare.3 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-41701"
      },
      "action_statement": "Vulnerability CVE-2026-41701 affects version 3.0.10-tuxcare.3 of org.springframework.amqp:spring-amqp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.0.10-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.0.10-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-15T13:42:00.561622+00:00",
      "status_notes": "Vulnerability CVE-2026-41714 affects version 3.0.10-tuxcare.3 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-41714"
      },
      "action_statement": "Vulnerability CVE-2026-41714 affects version 3.0.10-tuxcare.3 of org.springframework.amqp:spring-amqp."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.0.10-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.0.10-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-15T13:43:00.092864+00:00",
      "status_notes": "Vulnerability CVE-2026-47860 is fixed in version 3.0.10-tuxcare.3 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-47860"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.0.10-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.0.10-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-15T13:44:00.236667+00:00",
      "status_notes": "Vulnerability CVE-2026-59275 is fixed in version 3.0.10-tuxcare.3 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-59275"
      }
    }
  ]
}