{
  "@id": "urn:uuid:24bf2bea-3995-4620-ad68-2ff9a97f0a4d",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-11T14:49:00.043980+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-11T14:48:03.429674+00:00",
      "status_notes": "Vulnerability CVE-2016-2173 does not affect version 2.1.4.RELEASE-tuxcare.2 of org.springframework.amqp:spring-amqp. CVE-2016-2173 affects Spring AMQP before version 1.5.5, allowing arbitrary code execution through unprotected Java deserialization via DefaultDeserializer. The target version 2.1.4.RELEASE already contains the upstream fix introduced in version 1.5.5 (commit 462dcb6f1, dated 2016-03-15). The fix adds whitelist-based deserialization protection through the WhiteListDeserializingMessageConverter class, which blocks unauthorized classes via SerializationUtils.checkWhiteList() before allowing deserialization. This fix was authored by upstream Spring developers (Gary Russell, Pivotal) and was already present in the upstream release when TuxCare onboarded version 2.1.4.RELEASE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.5), Snyk (< 1.5.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-2173"
      },
      "impact_statement": "CVE-2016-2173 affects Spring AMQP before version 1.5.5, allowing arbitrary code execution through unprotected Java deserialization via DefaultDeserializer. The target version 2.1.4.RELEASE already contains the upstream fix introduced in version 1.5.5 (commit 462dcb6f1, dated 2016-03-15). The fix adds whitelist-based deserialization protection through the WhiteListDeserializingMessageConverter class, which blocks unauthorized classes via SerializationUtils.checkWhiteList() before allowing deserialization. This fix was authored by upstream Spring developers (Gary Russell, Pivotal) and was already present in the upstream release when TuxCare onboarded version 2.1.4.RELEASE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.5), Snyk (< 1.5.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-11T14:48:03.429674+00:00",
      "status_notes": "Vulnerability CVE-2017-8045 does not affect version 2.1.4.RELEASE-tuxcare.2 of org.springframework.amqp:spring-amqp. CVE-2017-8045 affects Spring AMQP before 1.5.7, 1.6.0\u20131.6.10 and 1.7.0\u20131.7.3 (Spring advisory, NVD); it is fixed upstream in 1.5.7, 1.6.11 and 1.7.4. Version 2.1.4.RELEASE is later than every fixed release and already contains the upstream fix, so the unsafe deserialization in Message.toString() is not present. The earlier checker verdict (fix_present, fixed by TuxCare via a9dc9a91) credited the wrong commit: a9dc9a91 is the CVE-2021-22097 backport, not a CVE-2017-8045 fix.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-8045"
      },
      "impact_statement": "CVE-2017-8045 affects Spring AMQP before 1.5.7, 1.6.0\u20131.6.10 and 1.7.0\u20131.7.3 (Spring advisory, NVD); it is fixed upstream in 1.5.7, 1.6.11 and 1.7.4. Version 2.1.4.RELEASE is later than every fixed release and already contains the upstream fix, so the unsafe deserialization in Message.toString() is not present. The earlier checker verdict (fix_present, fixed by TuxCare via a9dc9a91) credited the wrong commit: a9dc9a91 is the CVE-2021-22097 backport, not a CVE-2017-8045 fix."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-11T14:48:03.429674+00:00",
      "status_notes": "Vulnerability CVE-2018-11087 does not affect version 2.1.4.RELEASE-tuxcare.2 of org.springframework.amqp:spring-amqp. not_affected \u2014 CVE-2018-11087 (man-in-the-middle vulnerability due to lack of hostname validation) is NOT present in Spring AMQP 2.1.4.RELEASE-tuxcare.1. The fix was already included in the upstream Spring AMQP 2.1.4.RELEASE release that TuxCare onboarded. The target code has hostname verification enabled by default (line 137: enableHostnameVerification = true) and calls connectionFactory.enableHostnameVerifi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11087"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-11087 (man-in-the-middle vulnerability due to lack of hostname validation) is NOT present in Spring AMQP 2.1.4.RELEASE-tuxcare.1. The fix was already included in the upstream Spring AMQP 2.1.4.RELEASE release that TuxCare onboarded. The target code has hostname verification enabled by default (line 137: enableHostnameVerification = true) and calls connectionFactory.enableHostnameVerifi..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-11T14:48:03.429674+00:00",
      "status_notes": "Vulnerability CVE-2021-22095 is fixed in version 2.1.4.RELEASE-tuxcare.2 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2021-22095"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-11T14:49:00.043980+00:00",
      "status_notes": "Vulnerability CVE-2021-22097 is fixed in version 2.1.4.RELEASE-tuxcare.2 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2021-22097"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-11T14:49:00.043980+00:00",
      "status_notes": "Vulnerability CVE-2026-41701 is fixed in version 2.1.4.RELEASE-tuxcare.2 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-41701"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-11T14:49:00.043980+00:00",
      "status_notes": "Vulnerability CVE-2026-41714 is fixed in version 2.1.4.RELEASE-tuxcare.2 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-41714"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-11T14:48:03.429674+00:00",
      "status_notes": "Vulnerability CVE-2026-47860 is fixed in version 2.1.4.RELEASE-tuxcare.2 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-47860"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.4.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.4.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-11T14:48:03.429674+00:00",
      "status_notes": "Vulnerability CVE-2026-59275 does not affect version 2.1.4.RELEASE-tuxcare.2 of org.springframework.amqp:spring-amqp. not_affected \u2014 Target version 2.1.4.RELEASE is NOT affected by CVE-2026-59275. The vulnerability requires JavaLangErrorHandler calling System.exit(99) on StackOverflowError, which was introduced in v2.2.12 (commit 38794969, @since 2.2.12). Version 2.1.4 predates this feature and only has a benign Error catch handler (SimpleMessageListenerContainer.java:1107-1112) that aborts the consumer thread without termin...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59275"
      },
      "impact_statement": "not_affected \u2014 Target version 2.1.4.RELEASE is NOT affected by CVE-2026-59275. The vulnerability requires JavaLangErrorHandler calling System.exit(99) on StackOverflowError, which was introduced in v2.2.12 (commit 38794969, @since 2.2.12). Version 2.1.4 predates this feature and only has a benign Error catch handler (SimpleMessageListenerContainer.java:1107-1112) that aborts the consumer thread without termin..."
    }
  ]
}