{
  "@id": "urn:uuid:986834b7-8991-40db-9577-ae8747c02a24",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T11:15:00.139618+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-04T09:03:00.104314+00:00",
      "status_notes": "Vulnerability CVE-2016-2173 does not affect version 3.1.8-tuxcare.7 of org.springframework.amqp:spring-amqp. CVE-2016-2173 affects Spring AMQP before version 1.5.5 through unrestricted Java deserialization in DefaultDeserializer. The target version 3.1.8-tuxcare.7 contains the upstream fix (commit 462dcb6f1, AMQP-590) that introduced AllowedListDeserializingMessageConverter with mandatory class validation during deserialization. Both SerializerMessageConverter and SimpleMessageConverter now check deserialized classes against allowlist patterns via checkAllowedList(), throwing SecurityException for unauthorized classes. The fix was authored by Gary Russell (grussell@pivotal.io) and shipped in Spring AMQP 1.5.5 (March 2016), predating all TuxCare maintenance. The vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.5), Snyk (< 1.5.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-2173"
      },
      "impact_statement": "CVE-2016-2173 affects Spring AMQP before version 1.5.5 through unrestricted Java deserialization in DefaultDeserializer. The target version 3.1.8-tuxcare.7 contains the upstream fix (commit 462dcb6f1, AMQP-590) that introduced AllowedListDeserializingMessageConverter with mandatory class validation during deserialization. Both SerializerMessageConverter and SimpleMessageConverter now check deserialized classes against allowlist patterns via checkAllowedList(), throwing SecurityException for unauthorized classes. The fix was authored by Gary Russell (grussell@pivotal.io) and shipped in Spring AMQP 1.5.5 (March 2016), predating all TuxCare maintenance. The vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.5), Snyk (< 1.5.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-04T09:04:11.456857+00:00",
      "status_notes": "Vulnerability CVE-2017-8045 does not affect version 3.1.8-tuxcare.7 of org.springframework.amqp:spring-amqp. CVE-2017-8045 affects Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7 due to unsafe deserialization in Message.toString(). The target version 3.1.8-tuxcare.7 is NOT AFFECTED because the vulnerable code pattern has been removed by upstream fixes that were already present in the release before TuxCare onboarding. The current code at Message.java:119-121 safely returns \"[serialized object]\" instead of attempting deserialization, completely preventing the RCE attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.7; >= 1.6.0, < 1.6.11; >= 1.7.0, < 1.7.4), cve.org (< 1.7.4; = 1.6.11; = 1.5.7), Snyk (>= 1.5.6.RELEASE, < 1.5.7.RELEASE; >= 1.6.10.RELEASE, < 1.6.11.RELEASE; >= 1.7.3.RELEASE, < 1.7.4.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-8045"
      },
      "impact_statement": "CVE-2017-8045 affects Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7 due to unsafe deserialization in Message.toString(). The target version 3.1.8-tuxcare.7 is NOT AFFECTED because the vulnerable code pattern has been removed by upstream fixes that were already present in the release before TuxCare onboarding. The current code at Message.java:119-121 safely returns \"[serialized object]\" instead of attempting deserialization, completely preventing the RCE attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.7; >= 1.6.0, < 1.6.11; >= 1.7.0, < 1.7.4), cve.org (< 1.7.4; = 1.6.11; = 1.5.7), Snyk (>= 1.5.6.RELEASE, < 1.5.7.RELEASE; >= 1.6.10.RELEASE, < 1.6.11.RELEASE; >= 1.7.3.RELEASE, < 1.7.4.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-03T19:54:07.639499+00:00",
      "status_notes": "Vulnerability CVE-2018-11087 does not affect version 3.1.8-tuxcare.7 of org.springframework.amqp:spring-amqp. already_fixed \u2014 CVE-2018-11087 hostname verification vulnerability is NOT present in target version 3.1.8. The fix has already been applied via commits aff4d0ae, d64e7fa3, and 444b74e9 (JIRA AMQP-830), which enable hostname verification by default for TLS/SSL connections to RabbitMQ servers. The enableHostnameVerification field is set to true by default (line 158), and connectionFactory.enableHostnameVerificat...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11087"
      },
      "impact_statement": "already_fixed \u2014 CVE-2018-11087 hostname verification vulnerability is NOT present in target version 3.1.8. The fix has already been applied via commits aff4d0ae, d64e7fa3, and 444b74e9 (JIRA AMQP-830), which enable hostname verification by default for TLS/SSL connections to RabbitMQ servers. The enableHostnameVerification field is set to true by default (line 158), and connectionFactory.enableHostnameVerificat..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-03T19:54:07.639499+00:00",
      "status_notes": "Vulnerability CVE-2021-22095 does not affect version 3.1.8-tuxcare.7 of org.springframework.amqp:spring-amqp. not_affected \u2014 Target is Spring AMQP 3.1.8, significantly newer than CVE-affected versions (2.2.0-2.2.19, 2.3.0-2.3.11). The fix for CVE-2021-22095 was introduced in upstream version 2.2.20 and is present in 3.1.8. The Message.toString() method contains the required maxBodyLength check (default 50 bytes) that prevents OOM errors from large message bodies. Fix commit 4f3a1539da by Gary Russell (VMware) shipped...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22095"
      },
      "impact_statement": "not_affected \u2014 Target is Spring AMQP 3.1.8, significantly newer than CVE-affected versions (2.2.0-2.2.19, 2.3.0-2.3.11). The fix for CVE-2021-22095 was introduced in upstream version 2.2.20 and is present in 3.1.8. The Message.toString() method contains the required maxBodyLength check (default 50 bytes) that prevents OOM errors from large message bodies. Fix commit 4f3a1539da by Gary Russell (VMware) shipped..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-03T19:54:07.639499+00:00",
      "status_notes": "Vulnerability CVE-2021-22097 does not affect version 3.1.8-tuxcare.7 of org.springframework.amqp:spring-amqp. not_affected \u2014 CVE-2021-22097 is not present in Spring AMQP 3.1.8. The vulnerability involved unsafe deserialization in the Message.toString() method for messages with content type application/x-java-serialized-object. The fix was already included in the upstream release v2.4.0 (September 2021) and was present when TuxCare onboarded version 3.1.8. The target code returns the safe placeholder \"[serialized obje...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22097"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22097 is not present in Spring AMQP 3.1.8. The vulnerability involved unsafe deserialization in the Message.toString() method for messages with content type application/x-java-serialized-object. The fix was already included in the upstream release v2.4.0 (September 2021) and was present when TuxCare onboarded version 3.1.8. The target code returns the safe placeholder \"[serialized obje..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-06T11:15:00.139618+00:00",
      "status_notes": "Vulnerability CVE-2026-41701 affects version 3.1.8-tuxcare.7 of org.springframework.amqp:spring-amqp, and is fixed in 3.1.8-tuxcare.8.",
      "vulnerability": {
        "name": "CVE-2026-41701"
      },
      "action_statement": "Vulnerability CVE-2026-41701 affects version 3.1.8-tuxcare.7 of org.springframework.amqp:spring-amqp, and is fixed in 3.1.8-tuxcare.8."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-03T19:54:07.639499+00:00",
      "status_notes": "Vulnerability CVE-2026-41714 is fixed in version 3.1.8-tuxcare.7 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-41714"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-03T19:54:07.639499+00:00",
      "status_notes": "Vulnerability CVE-2026-47860 is fixed in version 3.1.8-tuxcare.7 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-47860"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-03T19:54:07.639499+00:00",
      "status_notes": "Vulnerability CVE-2026-59275 is fixed in version 3.1.8-tuxcare.7 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-59275"
      }
    }
  ]
}