{
  "@id": "urn:uuid:8090055a-50ae-4b6a-8ce0-377fab40b572",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 10,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:05:53.304095+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.12-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.12-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:03:00.104314+00:00",
      "status_notes": "Vulnerability CVE-2016-2173 does not affect version 3.1.12-tuxcare.4 of org.springframework.amqp:spring-amqp. The target Spring AMQP version 3.1.12-tuxcare.8 is not affected by CVE-2016-2173. The vulnerability involved unsafe Java deserialization in org.springframework.core.serializer.DefaultDeserializer that allowed remote attackers to execute arbitrary code. The upstream vendor (Spring/VMware) fixed this in version 1.5.5 by introducing AllowedListDeserializingMessageConverter with class allowlist validation. This fix was already present in the upstream release 3.1.12 that TuxCare onboarded, making the vulnerable pattern absent from the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.5), Snyk (< 1.5.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-2173"
      },
      "impact_statement": "The target Spring AMQP version 3.1.12-tuxcare.8 is not affected by CVE-2016-2173. The vulnerability involved unsafe Java deserialization in org.springframework.core.serializer.DefaultDeserializer that allowed remote attackers to execute arbitrary code. The upstream vendor (Spring/VMware) fixed this in version 1.5.5 by introducing AllowedListDeserializingMessageConverter with class allowlist validation. This fix was already present in the upstream release 3.1.12 that TuxCare onboarded, making the vulnerable pattern absent from the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.5), Snyk (< 1.5.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.12-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.12-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2017-8045 does not affect version 3.1.12-tuxcare.4 of org.springframework.amqp:spring-amqp. CVE-2017-8045 concerns unsafe deserialization in Spring AMQP's Message.toString() method, which allowed remote code execution when a malicious serialized payload was converted to a string. The upstream fix (commit ed824637c by Gary Russell @vmware.com, dated 2021-09-27) was already present in the upstream 3.1.12 release before TuxCare onboarded it. The fix completely removes deserialization from toString() and returns \"[serialized object]\" instead. The vulnerable pattern is not present in the target version 3.1.12.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.7; >= 1.6.0, < 1.6.11; >= 1.7.0, < 1.7.4), cve.org (< 1.7.4; = 1.6.11; = 1.5.7), Snyk (>= 1.5.6.RELEASE, < 1.5.7.RELEASE; >= 1.6.10.RELEASE, < 1.6.11.RELEASE; >= 1.7.3.RELEASE, < 1.7.4.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-8045"
      },
      "impact_statement": "CVE-2017-8045 concerns unsafe deserialization in Spring AMQP's Message.toString() method, which allowed remote code execution when a malicious serialized payload was converted to a string. The upstream fix (commit ed824637c by Gary Russell @vmware.com, dated 2021-09-27) was already present in the upstream 3.1.12 release before TuxCare onboarded it. The fix completely removes deserialization from toString() and returns \"[serialized object]\" instead. The vulnerable pattern is not present in the target version 3.1.12.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.7; >= 1.6.0, < 1.6.11; >= 1.7.0, < 1.7.4), cve.org (< 1.7.4; = 1.6.11; = 1.5.7), Snyk (>= 1.5.6.RELEASE, < 1.5.7.RELEASE; >= 1.6.10.RELEASE, < 1.6.11.RELEASE; >= 1.7.3.RELEASE, < 1.7.4.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.12-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.12-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2018-11087 does not affect version 3.1.12-tuxcare.4 of org.springframework.amqp:spring-amqp. not_affected \u2014 The target Spring AMQP 3.1.12 is NOT vulnerable to CVE-2018-11087. The vulnerability (lack of hostname verification in TLS connections) has been fixed by the upstream vendor (Pivotal/Spring). The fix commit 444b74e95bb299af5e23ebf006fbb45d574fb95e, authored by Gary Russell from Pivotal, added hostname verification enabled by default. This fix was first included in Spring AMQP 2.1.0.M3 and is pr...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11087"
      },
      "impact_statement": "not_affected \u2014 The target Spring AMQP 3.1.12 is NOT vulnerable to CVE-2018-11087. The vulnerability (lack of hostname verification in TLS connections) has been fixed by the upstream vendor (Pivotal/Spring). The fix commit 444b74e95bb299af5e23ebf006fbb45d574fb95e, authored by Gary Russell from Pivotal, added hostname verification enabled by default. This fix was first included in Spring AMQP 2.1.0.M3 and is pr..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.12-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.12-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T05:01:00.106690+00:00",
      "status_notes": "Vulnerability CVE-2021-22095 does not affect version 3.1.12-tuxcare.4 of org.springframework.amqp:spring-amqp. not_affected \u2014 CVE-2021-22095 is not present in spring-amqp 3.1.12. The vulnerability (unbounded String creation in Message.toString() causing OOM with large message bodies) was fixed by upstream Spring AMQP in commit 4f3a1539d (Gary Russell, Nov 2021), which added a configurable size limit check (default 50 bytes) before String conversion in the toString() method. This fix was already present in the upstream...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22095"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22095 is not present in spring-amqp 3.1.12. The vulnerability (unbounded String creation in Message.toString() causing OOM with large message bodies) was fixed by upstream Spring AMQP in commit 4f3a1539d (Gary Russell, Nov 2021), which added a configurable size limit check (default 50 bytes) before String conversion in the toString() method. This fix was already present in the upstream..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.12-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.12-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T05:04:00.209412+00:00",
      "status_notes": "Vulnerability CVE-2021-22097 does not affect version 3.1.12-tuxcare.4 of org.springframework.amqp:spring-amqp. not_affected \u2014 CVE-2021-22097 is NOT present in Spring AMQP 3.1.12-tuxcare.8. The vulnerable deserialization pattern in Message.toString() was already fixed in the upstream Spring AMQP 3.1.12 release that TuxCare onboarded. The fix (commit ed824637c by Gary Russell, grussell@vmware.com) replaces deserialization with a safe string literal \"[serialized object]\", preventing the 100% CPU exhaustion attack describ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22097"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22097 is NOT present in Spring AMQP 3.1.12-tuxcare.8. The vulnerable deserialization pattern in Message.toString() was already fixed in the upstream Spring AMQP 3.1.12 release that TuxCare onboarded. The fix (commit ed824637c by Gary Russell, grussell@vmware.com) replaces deserialization with a safe string literal \"[serialized object]\", preventing the 100% CPU exhaustion attack describ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.12-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.12-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-07T10:48:00.634805+00:00",
      "status_notes": "Vulnerability CVE-2026-41701 affects version 3.1.12-tuxcare.4 of org.springframework.amqp:spring-amqp, and is fixed in 3.1.12-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-41701"
      },
      "action_statement": "Vulnerability CVE-2026-41701 affects version 3.1.12-tuxcare.4 of org.springframework.amqp:spring-amqp, and is fixed in 3.1.12-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.12-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.12-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-07T10:48:00.634805+00:00",
      "status_notes": "Vulnerability CVE-2026-41714 affects version 3.1.12-tuxcare.4 of org.springframework.amqp:spring-amqp, and is fixed in 3.1.12-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-41714"
      },
      "action_statement": "Vulnerability CVE-2026-41714 affects version 3.1.12-tuxcare.4 of org.springframework.amqp:spring-amqp, and is fixed in 3.1.12-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.12-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.12-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-15T15:04:00.820733+00:00",
      "status_notes": "Vulnerability CVE-2026-47860 affects version 3.1.12-tuxcare.4 of org.springframework.amqp:spring-amqp, and is fixed in 3.1.12-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2026-47860"
      },
      "action_statement": "Vulnerability CVE-2026-47860 affects version 3.1.12-tuxcare.4 of org.springframework.amqp:spring-amqp, and is fixed in 3.1.12-tuxcare.7."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.12-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.12-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-15T15:04:00.820733+00:00",
      "status_notes": "Vulnerability CVE-2026-59275 affects version 3.1.12-tuxcare.4 of org.springframework.amqp:spring-amqp, and is fixed in 3.1.12-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2026-59275"
      },
      "action_statement": "Vulnerability CVE-2026-59275 affects version 3.1.12-tuxcare.4 of org.springframework.amqp:spring-amqp, and is fixed in 3.1.12-tuxcare.7."
    }
  ]
}