{
  "@id": "urn:uuid:dd861089-f983-4632-b09e-be52baab43c8",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 5,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-08T16:49:24.684639+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.0.8.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.0.8.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2016-2173 does not affect version 2.0.8.RELEASE-tuxcare.1 of org.springframework.amqp:spring-amqp. The target repository (Spring AMQP 2.0.8.RELEASE) contains the white-list deserialization defense mechanism introduced by the upstream vendor to fix CVE-2016-2173. The fix was authored by Gary Russell (grussell@pivotal.io) in commit 462dcb6f1 on March 15, 2016, and was already present in the upstream release 2.0.8.RELEASE when TuxCare onboarded it on Nov 2, 2026. The vulnerable pattern (unrestricted Java deserialization with no white-list mechanism) is not present in HEAD. However, the white-list defense is disabled by default (empty list allows all classes), requiring users to configure white-list patterns when accepting messages from untrusted sources. This is the vendor's intended mitigation strategy as documented in the reference documentation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.5), Snyk (< 1.5.5).",
      "vulnerability": {
        "name": "CVE-2016-2173"
      },
      "impact_statement": "The target repository (Spring AMQP 2.0.8.RELEASE) contains the white-list deserialization defense mechanism introduced by the upstream vendor to fix CVE-2016-2173. The fix was authored by Gary Russell (grussell@pivotal.io) in commit 462dcb6f1 on March 15, 2016, and was already present in the upstream release 2.0.8.RELEASE when TuxCare onboarded it on Nov 2, 2026. The vulnerable pattern (unrestricted Java deserialization with no white-list mechanism) is not present in HEAD. However, the white-list defense is disabled by default (empty list allows all classes), requiring users to configure white-list patterns when accepting messages from untrusted sources. This is the vendor's intended mitigation strategy as documented in the reference documentation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.5), Snyk (< 1.5.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.0.8.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.0.8.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2017-8045 does not affect version 2.0.8.RELEASE-tuxcare.1 of org.springframework.amqp:spring-amqp. CVE-2017-8045 is not present in Spring AMQP 2.0.8.RELEASE. The vulnerability involved unsafe deserialization in Message.toString() that could enable remote code execution. The fix (commit 36e55998f by Gary Russell) was already included in the upstream 2.0.8.RELEASE before TuxCare onboarding. The vulnerable pattern (direct SerializationUtils.deserialize() call) has been replaced with whitelist-protected deserialization limiting classes to java.util.* and java.lang.*.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.7; >= 1.6.0, < 1.6.11; >= 1.7.0, < 1.7.4), cve.org (< 1.7.4; = 1.6.11; = 1.5.7), Snyk (>= 1.5.6.RELEASE, < 1.5.7.RELEASE; >= 1.6.10.RELEASE, < 1.6.11.RELEASE; >= 1.7.3.RELEASE, < 1.7.4.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-8045"
      },
      "impact_statement": "CVE-2017-8045 is not present in Spring AMQP 2.0.8.RELEASE. The vulnerability involved unsafe deserialization in Message.toString() that could enable remote code execution. The fix (commit 36e55998f by Gary Russell) was already included in the upstream 2.0.8.RELEASE before TuxCare onboarding. The vulnerable pattern (direct SerializationUtils.deserialize() call) has been replaced with whitelist-protected deserialization limiting classes to java.util.* and java.lang.*.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.7; >= 1.6.0, < 1.6.11; >= 1.7.0, < 1.7.4), cve.org (< 1.7.4; = 1.6.11; = 1.5.7), Snyk (>= 1.5.6.RELEASE, < 1.5.7.RELEASE; >= 1.6.10.RELEASE, < 1.6.11.RELEASE; >= 1.7.3.RELEASE, < 1.7.4.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.0.8.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.0.8.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T14:17:00.037131+00:00",
      "status_notes": "Vulnerability CVE-2018-11087 does not affect version 2.0.8.RELEASE-tuxcare.1 of org.springframework.amqp:spring-amqp. The upstream fix was released in 2.0.6, and version 2.0.8.RELEASE is a later release of the same line. Advisories: GitHub GHSA-w4g2-9hj6-5472 (fixed in 2.0.6), CVE record (fixed in 2.0.6), Snyk (fixed in 2.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11087"
      },
      "impact_statement": "The upstream fix was released in 2.0.6, and version 2.0.8.RELEASE is a later release of the same line. Advisories: GitHub GHSA-w4g2-9hj6-5472 (fixed in 2.0.6), CVE record (fixed in 2.0.6), Snyk (fixed in 2.0.6.RELEASE)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.0.8.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.0.8.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-08T16:49:24.684639+00:00",
      "status_notes": "Vulnerability CVE-2021-22095 affects version 2.0.8.RELEASE-tuxcare.1 of org.springframework.amqp:spring-amqp, and is fixed in 2.0.8.RELEASE-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2021-22095"
      },
      "action_statement": "Vulnerability CVE-2021-22095 affects version 2.0.8.RELEASE-tuxcare.1 of org.springframework.amqp:spring-amqp, and is fixed in 2.0.8.RELEASE-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.0.8.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.0.8.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-08T16:49:24.684639+00:00",
      "status_notes": "Vulnerability CVE-2021-22097 affects version 2.0.8.RELEASE-tuxcare.1 of org.springframework.amqp:spring-amqp, and is fixed in 2.0.8.RELEASE-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2021-22097"
      },
      "action_statement": "Vulnerability CVE-2021-22097 affects version 2.0.8.RELEASE-tuxcare.1 of org.springframework.amqp:spring-amqp, and is fixed in 2.0.8.RELEASE-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.0.8.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.0.8.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-08T16:49:24.684639+00:00",
      "status_notes": "Vulnerability CVE-2026-41701 affects version 2.0.8.RELEASE-tuxcare.1 of org.springframework.amqp:spring-amqp, and is fixed in 2.0.8.RELEASE-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-41701"
      },
      "action_statement": "Vulnerability CVE-2026-41701 affects version 2.0.8.RELEASE-tuxcare.1 of org.springframework.amqp:spring-amqp, and is fixed in 2.0.8.RELEASE-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.0.8.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.0.8.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-08T16:49:24.684639+00:00",
      "status_notes": "Vulnerability CVE-2026-41714 affects version 2.0.8.RELEASE-tuxcare.1 of org.springframework.amqp:spring-amqp, and is fixed in 2.0.8.RELEASE-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-41714"
      },
      "action_statement": "Vulnerability CVE-2026-41714 affects version 2.0.8.RELEASE-tuxcare.1 of org.springframework.amqp:spring-amqp, and is fixed in 2.0.8.RELEASE-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.0.8.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.0.8.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-08T16:49:24.684639+00:00",
      "status_notes": "Vulnerability CVE-2026-47860 affects version 2.0.8.RELEASE-tuxcare.1 of org.springframework.amqp:spring-amqp, and is fixed in 2.0.8.RELEASE-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-47860"
      },
      "action_statement": "Vulnerability CVE-2026-47860 affects version 2.0.8.RELEASE-tuxcare.1 of org.springframework.amqp:spring-amqp, and is fixed in 2.0.8.RELEASE-tuxcare.2."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.0.8.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.0.8.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T03:55:02.426789+00:00",
      "status_notes": "Vulnerability CVE-2026-59275 does not affect version 2.0.8.RELEASE-tuxcare.1 of org.springframework.amqp:spring-amqp. not_affected \u2014 Version 2.0.8.RELEASE is not affected by CVE-2026-59275. While the target contains the array component bypass flaw in WhiteListDeserializingMessageConverter (lines 65-67 allow arrays to bypass the allowlist without checking their component types), it lacks the critical System.exit(99) code path that would enable the CVE's described attack. The javaLangErrorHandler feature with System.exit(99) w...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-59275"
      },
      "impact_statement": "not_affected \u2014 Version 2.0.8.RELEASE is not affected by CVE-2026-59275. While the target contains the array component bypass flaw in WhiteListDeserializingMessageConverter (lines 65-67 allow arrays to bypass the allowlist without checking their component types), it lacks the critical System.exit(99) code path that would enable the CVE's described attack. The javaLangErrorHandler feature with System.exit(99) w..."
    }
  ]
}