{
  "@id": "urn:uuid:9f2883e2-c47a-4d48-8252-f51f7abf6890",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-08T21:23:03.417077+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.5.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.5.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T10:35:49.239886+00:00",
      "status_notes": "Vulnerability CVE-2016-2173 does not affect version 2.1.5.RELEASE-tuxcare.2 of org.springframework.amqp:spring-amqp. CVE-2016-2173 affects Spring AMQP versions before 1.5.5 due to unrestricted Java deserialization in DefaultDeserializer. The target version 2.1.5.RELEASE already contains the upstream fix introduced in version 1.5.5: whitelist-based deserialization filtering via WhiteListDeserializingMessageConverter and SerializationUtils.checkWhiteList(). This fix was present in the upstream 2.1.5.RELEASE that TuxCare onboarded (commit 1a6b146179680d0961586b7f93b299ff5baef60c by amoniatovskiy@cloudlinux.com), not applied as a separate TuxCare backport. The vulnerable code pattern (unrestricted ObjectInputStream deserialization without any filtering mechanism) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.5), Snyk (< 1.5.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-2173"
      },
      "impact_statement": "CVE-2016-2173 affects Spring AMQP versions before 1.5.5 due to unrestricted Java deserialization in DefaultDeserializer. The target version 2.1.5.RELEASE already contains the upstream fix introduced in version 1.5.5: whitelist-based deserialization filtering via WhiteListDeserializingMessageConverter and SerializationUtils.checkWhiteList(). This fix was present in the upstream 2.1.5.RELEASE that TuxCare onboarded (commit 1a6b146179680d0961586b7f93b299ff5baef60c by amoniatovskiy@cloudlinux.com), not applied as a separate TuxCare backport. The vulnerable code pattern (unrestricted ObjectInputStream deserialization without any filtering mechanism) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.5), Snyk (< 1.5.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.5.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.5.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T10:35:49.239886+00:00",
      "status_notes": "Vulnerability CVE-2017-8045 does not affect version 2.1.5.RELEASE-tuxcare.2 of org.springframework.amqp:spring-amqp. CVE-2017-8045 describes unsafe Java deserialization in Spring AMQP's Message.toString() method. The target version 2.1.5.RELEASE already contains the upstream fix introduced in commit 36e55998f6 (AMQP-766) by Gary Russell on 2017-09-06. The fix implements whitelist-based deserialization via SerializationUtils.deserialize() with default patterns restricting deserialization to java.util.* and java.lang.* classes, blocking arbitrary deserialization attacks. This fix was already present in the upstream 2.1.5.RELEASE when TuxCare onboarded it in commit 1a6b14617, making this an upstream vendor fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.7; >= 1.6.0, < 1.6.11; >= 1.7.0, < 1.7.4), cve.org (< 1.7.4; = 1.6.11; = 1.5.7), Snyk (>= 1.5.6.RELEASE, < 1.5.7.RELEASE; >= 1.6.10.RELEASE, < 1.6.11.RELEASE; >= 1.7.3.RELEASE, < 1.7.4.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-8045"
      },
      "impact_statement": "CVE-2017-8045 describes unsafe Java deserialization in Spring AMQP's Message.toString() method. The target version 2.1.5.RELEASE already contains the upstream fix introduced in commit 36e55998f6 (AMQP-766) by Gary Russell on 2017-09-06. The fix implements whitelist-based deserialization via SerializationUtils.deserialize() with default patterns restricting deserialization to java.util.* and java.lang.* classes, blocking arbitrary deserialization attacks. This fix was already present in the upstream 2.1.5.RELEASE when TuxCare onboarded it in commit 1a6b14617, making this an upstream vendor fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.7; >= 1.6.0, < 1.6.11; >= 1.7.0, < 1.7.4), cve.org (< 1.7.4; = 1.6.11; = 1.5.7), Snyk (>= 1.5.6.RELEASE, < 1.5.7.RELEASE; >= 1.6.10.RELEASE, < 1.6.11.RELEASE; >= 1.7.3.RELEASE, < 1.7.4.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.5.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.5.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T10:35:49.239886+00:00",
      "status_notes": "Vulnerability CVE-2018-11087 does not affect version 2.1.5.RELEASE-tuxcare.2 of org.springframework.amqp:spring-amqp. not_affected \u2014 The target repository (Spring AMQP 2.1.5.RELEASE-tuxcare.1) is NOT affected by CVE-2018-11087. The vulnerability concerns missing hostname verification during TLS connections to RabbitMQ servers, which could allow man-in-the-middle attacks. The fix for this vulnerability was implemented in upstream Spring AMQP 2.0.6 (commit 444b74e95 by Gary Russell from Pivotal) and is present in the target ve...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11087"
      },
      "impact_statement": "not_affected \u2014 The target repository (Spring AMQP 2.1.5.RELEASE-tuxcare.1) is NOT affected by CVE-2018-11087. The vulnerability concerns missing hostname verification during TLS connections to RabbitMQ servers, which could allow man-in-the-middle attacks. The fix for this vulnerability was implemented in upstream Spring AMQP 2.0.6 (commit 444b74e95 by Gary Russell from Pivotal) and is present in the target ve..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.5.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.5.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-08T21:23:03.417077+00:00",
      "status_notes": "Vulnerability CVE-2021-22095 affects version 2.1.5.RELEASE-tuxcare.2 of org.springframework.amqp:spring-amqp, and is fixed in 2.1.5.RELEASE-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2021-22095"
      },
      "action_statement": "Vulnerability CVE-2021-22095 affects version 2.1.5.RELEASE-tuxcare.2 of org.springframework.amqp:spring-amqp, and is fixed in 2.1.5.RELEASE-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.5.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.5.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-08T21:23:03.417077+00:00",
      "status_notes": "Vulnerability CVE-2021-22097 affects version 2.1.5.RELEASE-tuxcare.2 of org.springframework.amqp:spring-amqp, and is fixed in 2.1.5.RELEASE-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2021-22097"
      },
      "action_statement": "Vulnerability CVE-2021-22097 affects version 2.1.5.RELEASE-tuxcare.2 of org.springframework.amqp:spring-amqp, and is fixed in 2.1.5.RELEASE-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.5.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.5.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-08T21:23:03.417077+00:00",
      "status_notes": "Vulnerability CVE-2026-41701 affects version 2.1.5.RELEASE-tuxcare.2 of org.springframework.amqp:spring-amqp, and is fixed in 2.1.5.RELEASE-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-41701"
      },
      "action_statement": "Vulnerability CVE-2026-41701 affects version 2.1.5.RELEASE-tuxcare.2 of org.springframework.amqp:spring-amqp, and is fixed in 2.1.5.RELEASE-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.5.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.5.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-08T21:23:03.417077+00:00",
      "status_notes": "Vulnerability CVE-2026-41714 affects version 2.1.5.RELEASE-tuxcare.2 of org.springframework.amqp:spring-amqp, and is fixed in 2.1.5.RELEASE-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-41714"
      },
      "action_statement": "Vulnerability CVE-2026-41714 affects version 2.1.5.RELEASE-tuxcare.2 of org.springframework.amqp:spring-amqp, and is fixed in 2.1.5.RELEASE-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.5.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.5.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-08T21:23:03.417077+00:00",
      "status_notes": "Vulnerability CVE-2026-47860 affects version 2.1.5.RELEASE-tuxcare.2 of org.springframework.amqp:spring-amqp, and is fixed in 2.1.5.RELEASE-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-47860"
      },
      "action_statement": "Vulnerability CVE-2026-47860 affects version 2.1.5.RELEASE-tuxcare.2 of org.springframework.amqp:spring-amqp, and is fixed in 2.1.5.RELEASE-tuxcare.3."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.5.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.5.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T10:35:49.239886+00:00",
      "status_notes": "Vulnerability CVE-2026-59275 does not affect version 2.1.5.RELEASE-tuxcare.2 of org.springframework.amqp:spring-amqp. not_affected \u2014 Version 2.1.5.RELEASE is not affected by CVE-2026-59275. The vulnerability requires the javaLangErrorHandler feature that calls System.exit(99) on Error exceptions. This feature was introduced in Spring AMQP 2.2.12 and does not exist in version 2.1.5. When Errors occur in 2.1.5, they are caught, logged, and the listener thread aborts, but the JVM continues running. No System.exit calls exist an...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59275"
      },
      "impact_statement": "not_affected \u2014 Version 2.1.5.RELEASE is not affected by CVE-2026-59275. The vulnerability requires the javaLangErrorHandler feature that calls System.exit(99) on Error exceptions. This feature was introduced in Spring AMQP 2.2.12 and does not exist in version 2.1.5. When Errors occur in 2.1.5, they are caught, logged, and the listener thread aborts, but the JVM continues running. No System.exit calls exist an..."
    }
  ]
}