{
  "@id": "urn:uuid:d91bfdc4-7264-4229-b721-12aa242721a9",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 9,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:05:53.304095+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.2.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.2.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2016-2173 does not affect version 3.2.8-tuxcare.2 of org.springframework.amqp:spring-amqp. CVE-2016-2173 affects Spring AMQP versions before 1.5.5 due to unrestricted Java deserialization in DefaultDeserializer. The target version 3.2.8 contains the upstream fix introduced in version 1.5.5 (commit 462dcb6f1 by Gary Russell from Pivotal). The fix added an allowed list checking mechanism (AllowedListDeserializingMessageConverter) that blocks unauthorized classes from being deserialized by default. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.5), Snyk (< 1.5.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-2173"
      },
      "impact_statement": "CVE-2016-2173 affects Spring AMQP versions before 1.5.5 due to unrestricted Java deserialization in DefaultDeserializer. The target version 3.2.8 contains the upstream fix introduced in version 1.5.5 (commit 462dcb6f1 by Gary Russell from Pivotal). The fix added an allowed list checking mechanism (AllowedListDeserializingMessageConverter) that blocks unauthorized classes from being deserialized by default. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.5), Snyk (< 1.5.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.2.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.2.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2017-8045 does not affect version 3.2.8-tuxcare.2 of org.springframework.amqp:spring-amqp. CVE-2017-8045 describes unsafe Java deserialization in org.springframework.amqp.core.Message.toString() that could lead to remote code execution. The target repository (Spring AMQP 3.2.8-tuxcare.3) is NOT affected because the vulnerable deserialization code has been removed by an upstream fix that was already present in Spring AMQP 3.2.8 when TuxCare onboarded it. The current code safely returns \"[serialized object]\" instead of deserializing message bodies with CONTENT_TYPE_SERIALIZED_OBJECT.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.7; >= 1.6.0, < 1.6.11; >= 1.7.0, < 1.7.4), cve.org (< 1.7.4; = 1.6.11; = 1.5.7), Snyk (>= 1.5.6.RELEASE, < 1.5.7.RELEASE; >= 1.6.10.RELEASE, < 1.6.11.RELEASE; >= 1.7.3.RELEASE, < 1.7.4.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-8045"
      },
      "impact_statement": "CVE-2017-8045 describes unsafe Java deserialization in org.springframework.amqp.core.Message.toString() that could lead to remote code execution. The target repository (Spring AMQP 3.2.8-tuxcare.3) is NOT affected because the vulnerable deserialization code has been removed by an upstream fix that was already present in Spring AMQP 3.2.8 when TuxCare onboarded it. The current code safely returns \"[serialized object]\" instead of deserializing message bodies with CONTENT_TYPE_SERIALIZED_OBJECT.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.7; >= 1.6.0, < 1.6.11; >= 1.7.0, < 1.7.4), cve.org (< 1.7.4; = 1.6.11; = 1.5.7), Snyk (>= 1.5.6.RELEASE, < 1.5.7.RELEASE; >= 1.6.10.RELEASE, < 1.6.11.RELEASE; >= 1.7.3.RELEASE, < 1.7.4.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.2.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.2.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T01:26:39.724365+00:00",
      "status_notes": "Vulnerability CVE-2018-11087 does not affect version 3.2.8-tuxcare.2 of org.springframework.amqp:spring-amqp. not_affected \u2014 CVE-2018-11087 affects Pivotal Spring AMQP 1.x prior to 1.7.10 and 2.x prior to 2.0.6 due to lack of hostname verification in TLS/SSL connections. The target repository at version 3.2.8 (commit ddf2cb9c1) contains the upstream fix that enables hostname verification by default. The fix was authored by Gary Russell (grussell@pivotal.io) in commit 444b74e95b and shipped in the upstream Spring AMQP...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11087"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-11087 affects Pivotal Spring AMQP 1.x prior to 1.7.10 and 2.x prior to 2.0.6 due to lack of hostname verification in TLS/SSL connections. The target repository at version 3.2.8 (commit ddf2cb9c1) contains the upstream fix that enables hostname verification by default. The fix was authored by Gary Russell (grussell@pivotal.io) in commit 444b74e95b and shipped in the upstream Spring AMQP..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.2.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.2.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T05:02:57.848250+00:00",
      "status_notes": "Vulnerability CVE-2021-22095 does not affect version 3.2.8-tuxcare.2 of org.springframework.amqp:spring-amqp. not_affected \u2014 CVE-2021-22095 is NOT present in Spring AMQP 3.2.8. The vulnerability was fixed by upstream vendor (VMware) in commit 4f3a1539d before TuxCare onboarded this version. The fix adds a configurable size limit (default 50 bytes) to prevent unbounded string conversion of large message bodies in Message.toString(), effectively preventing OOM conditions. The defense code is present at Message.java lin...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22095"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22095 is NOT present in Spring AMQP 3.2.8. The vulnerability was fixed by upstream vendor (VMware) in commit 4f3a1539d before TuxCare onboarded this version. The fix adds a configurable size limit (default 50 bytes) to prevent unbounded string conversion of large message bodies in Message.toString(), effectively preventing OOM conditions. The defense code is present at Message.java lin..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.2.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.2.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T05:05:00.060068+00:00",
      "status_notes": "Vulnerability CVE-2021-22097 does not affect version 3.2.8-tuxcare.2 of org.springframework.amqp:spring-amqp. not_affected \u2014 CVE-2021-22097 is NOT present in Spring AMQP version 3.2.8. The vulnerability involved unsafe deserialization in Message.toString() that could cause CPU exhaustion. The fix (returning \"[serialized object]\" instead of deserializing) was implemented by upstream Spring in commit 61f9195c0b721fea71244ec9a74128127dcd343e (September 2021), first released in v2.2.19.RELEASE. Version 3.2.8 was onboarde...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22097"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22097 is NOT present in Spring AMQP version 3.2.8. The vulnerability involved unsafe deserialization in Message.toString() that could cause CPU exhaustion. The fix (returning \"[serialized object]\" instead of deserializing) was implemented by upstream Spring in commit 61f9195c0b721fea71244ec9a74128127dcd343e (September 2021), first released in v2.2.19.RELEASE. Version 3.2.8 was onboarde..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.2.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.2.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:49:20.450511+00:00",
      "status_notes": "Vulnerability CVE-2026-41701 affects version 3.2.8-tuxcare.2 of org.springframework.amqp:spring-amqp, and is fixed in 3.2.8-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-41701"
      },
      "action_statement": "Vulnerability CVE-2026-41701 affects version 3.2.8-tuxcare.2 of org.springframework.amqp:spring-amqp, and is fixed in 3.2.8-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.2.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.2.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T18:49:20.450511+00:00",
      "status_notes": "Vulnerability CVE-2026-41714 affects version 3.2.8-tuxcare.2 of org.springframework.amqp:spring-amqp, and is fixed in 3.2.8-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-41714"
      },
      "action_statement": "Vulnerability CVE-2026-41714 affects version 3.2.8-tuxcare.2 of org.springframework.amqp:spring-amqp, and is fixed in 3.2.8-tuxcare.3."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.2.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.2.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-23T09:11:49.826720+00:00",
      "status_notes": "Vulnerability CVE-2026-47860 is fixed in version 3.2.8-tuxcare.2 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-47860"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.2.8-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.2.8-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-23T09:11:49.826720+00:00",
      "status_notes": "Vulnerability CVE-2026-59275 is fixed in version 3.2.8-tuxcare.2 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-59275"
      }
    }
  ]
}