{
  "@id": "urn:uuid:b4ad9ba4-e26e-4b77-8934-041bc7a94b9f",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 7,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:07:59.808671+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.8.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.8.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2016-2173 does not affect version 2.1.8.RELEASE-tuxcare.2 of org.springframework.amqp:spring-amqp. CVE-2016-2173 concerns unsafe Java deserialization in Spring AMQP before 1.5.5. The target version 2.1.8.RELEASE contains the upstream fix (commit 462dcb6f1, March 2016) that introduced WhiteListDeserializingMessageConverter with whitelist-based deserialization protection. Both SerializerMessageConverter and SimpleMessageConverter extend this class and call checkWhiteList during deserialization. However, the whitelist is EMPTY by default, meaning all classes can be deserialized unless explicitly configured. The fix mechanism is present but requires configuration (setWhiteListPatterns) to be effective. Since this is an upstream fix authored by Gary Russell (grussell@pivotal.io) and shipped in the upstream release before TuxCare's involvement, the verdict is not_affected with justification requires_configuration.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.5), Snyk (< 1.5.5).",
      "vulnerability": {
        "name": "CVE-2016-2173"
      },
      "impact_statement": "CVE-2016-2173 concerns unsafe Java deserialization in Spring AMQP before 1.5.5. The target version 2.1.8.RELEASE contains the upstream fix (commit 462dcb6f1, March 2016) that introduced WhiteListDeserializingMessageConverter with whitelist-based deserialization protection. Both SerializerMessageConverter and SimpleMessageConverter extend this class and call checkWhiteList during deserialization. However, the whitelist is EMPTY by default, meaning all classes can be deserialized unless explicitly configured. The fix mechanism is present but requires configuration (setWhiteListPatterns) to be effective. Since this is an upstream fix authored by Gary Russell (grussell@pivotal.io) and shipped in the upstream release before TuxCare's involvement, the verdict is not_affected with justification requires_configuration.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.5), Snyk (< 1.5.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.8.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.8.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:07:59.808671+00:00",
      "status_notes": "Vulnerability CVE-2017-8045 does not affect version 2.1.8.RELEASE-tuxcare.2 of org.springframework.amqp:spring-amqp. CVE-2017-8045 describes unsafe deserialization in Spring AMQP's Message.toString() method. The target version 2.1.8.RELEASE already contains the upstream fix (commit 36e55998f from Sept 2017) that replaced unsafe deserialization with whitelist-based protection. The vulnerable code pattern (SerializationUtils.deserialize in toString) is not present in this version, as it was fixed in the upstream release prior to TuxCare onboarding. Additionally, a later TuxCare backport (CVE-2021-22097) further strengthened the protection by completely removing deserialization, now returning \"[serialized object]\" instead.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.7; >= 1.6.0, < 1.6.11; >= 1.7.0, < 1.7.4), cve.org (< 1.7.4; = 1.6.11; = 1.5.7), Snyk (>= 1.5.6.RELEASE, < 1.5.7.RELEASE; >= 1.6.10.RELEASE, < 1.6.11.RELEASE; >= 1.7.3.RELEASE, < 1.7.4.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-8045"
      },
      "impact_statement": "CVE-2017-8045 describes unsafe deserialization in Spring AMQP's Message.toString() method. The target version 2.1.8.RELEASE already contains the upstream fix (commit 36e55998f from Sept 2017) that replaced unsafe deserialization with whitelist-based protection. The vulnerable code pattern (SerializationUtils.deserialize in toString) is not present in this version, as it was fixed in the upstream release prior to TuxCare onboarding. Additionally, a later TuxCare backport (CVE-2021-22097) further strengthened the protection by completely removing deserialization, now returning \"[serialized object]\" instead.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.7; >= 1.6.0, < 1.6.11; >= 1.7.0, < 1.7.4), cve.org (< 1.7.4; = 1.6.11; = 1.5.7), Snyk (>= 1.5.6.RELEASE, < 1.5.7.RELEASE; >= 1.6.10.RELEASE, < 1.6.11.RELEASE; >= 1.7.3.RELEASE, < 1.7.4.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.8.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.8.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T01:26:39.724365+00:00",
      "status_notes": "Vulnerability CVE-2018-11087 does not affect version 2.1.8.RELEASE-tuxcare.2 of org.springframework.amqp:spring-amqp. not_affected \u2014 CVE-2018-11087 affects Spring AMQP versions 1.x prior to 1.7.10 and 2.x prior to 2.0.6 due to lack of hostname verification in TLS connections, exposing man-in-the-middle vulnerabilities. The target repository (version 2.1.8.RELEASE-tuxcare.2) is NOT AFFECTED because the upstream vendor fix was already present in version 2.0.6 and all subsequent releases including 2.1.8.RELEASE. The fix enables...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11087"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-11087 affects Spring AMQP versions 1.x prior to 1.7.10 and 2.x prior to 2.0.6 due to lack of hostname verification in TLS connections, exposing man-in-the-middle vulnerabilities. The target repository (version 2.1.8.RELEASE-tuxcare.2) is NOT AFFECTED because the upstream vendor fix was already present in version 2.0.6 and all subsequent releases including 2.1.8.RELEASE. The fix enables..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.8.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.8.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-15T17:41:12.186485+00:00",
      "status_notes": "Vulnerability CVE-2021-22095 is fixed in version 2.1.8.RELEASE-tuxcare.2 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2021-22095"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.8.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.8.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-15T17:41:12.186485+00:00",
      "status_notes": "Vulnerability CVE-2021-22097 is fixed in version 2.1.8.RELEASE-tuxcare.2 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2021-22097"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.8.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.8.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-15T17:41:12.186485+00:00",
      "status_notes": "Vulnerability CVE-2026-41701 affects version 2.1.8.RELEASE-tuxcare.2 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-41701"
      },
      "action_statement": "Vulnerability CVE-2026-41701 affects version 2.1.8.RELEASE-tuxcare.2 of org.springframework.amqp:spring-amqp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.8.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.8.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-15T17:41:12.186485+00:00",
      "status_notes": "Vulnerability CVE-2026-41714 affects version 2.1.8.RELEASE-tuxcare.2 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-41714"
      },
      "action_statement": "Vulnerability CVE-2026-41714 affects version 2.1.8.RELEASE-tuxcare.2 of org.springframework.amqp:spring-amqp."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.8.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.8.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-15T17:42:00.101351+00:00",
      "status_notes": "Vulnerability CVE-2026-47860 is fixed in version 2.1.8.RELEASE-tuxcare.2 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-47860"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.8.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.1.8.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-15T17:42:00.101351+00:00",
      "status_notes": "Vulnerability CVE-2026-59275 is fixed in version 2.1.8.RELEASE-tuxcare.2 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-59275"
      }
    }
  ]
}