{
  "@id": "urn:uuid:b7099458-d20f-4057-ba39-c69ff191aebf",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 7,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:10:25.284357+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2016-2173 does not affect version 2.3.10-tuxcare.1 of org.springframework.amqp:spring-amqp. CVE-2016-2173 affects Spring AMQP before 1.5.5 due to unsafe Java deserialization in DefaultDeserializer. The target version 2.3.10-tuxcare.3 contains the upstream vendor fix (commit 462dcb6f1 \"AMQP-590: Java Deserialization White List\") that was shipped in the upstream 2.3.10 release. Both SerializerMessageConverter and SimpleMessageConverter now extend AllowedListDeserializingMessageConverter and implement checkAllowedList() during deserialization to prevent unauthorized class instantiation. The vulnerable pattern (unprotected deserialization) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.5), Snyk (< 1.5.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-2173"
      },
      "impact_statement": "CVE-2016-2173 affects Spring AMQP before 1.5.5 due to unsafe Java deserialization in DefaultDeserializer. The target version 2.3.10-tuxcare.3 contains the upstream vendor fix (commit 462dcb6f1 \"AMQP-590: Java Deserialization White List\") that was shipped in the upstream 2.3.10 release. Both SerializerMessageConverter and SimpleMessageConverter now extend AllowedListDeserializingMessageConverter and implement checkAllowedList() during deserialization to prevent unauthorized class instantiation. The vulnerable pattern (unprotected deserialization) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.5), Snyk (< 1.5.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2017-8045 does not affect version 2.3.10-tuxcare.1 of org.springframework.amqp:spring-amqp. CVE-2017-8045 affects Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7 due to unsafe deserialization in Message.toString(). The target version 2.3.10-tuxcare.3 is not vulnerable because the fix (AMQP-766: allow-list for deserialization) was already present in the upstream Spring AMQP 2.3.10 release that TuxCare onboarded. The fix commit (36e55998f) was authored by upstream Spring maintainer Gary Russell and shipped in the upstream release before any TuxCare modifications. Later, CVE-2021-22095 prompted complete removal of deserialization, but for CVE-2017-8045 specifically, the allow-list approach was the official fix and was already present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.7; >= 1.6.0, < 1.6.11; >= 1.7.0, < 1.7.4), cve.org (< 1.7.4; = 1.6.11; = 1.5.7), Snyk (>= 1.5.6.RELEASE, < 1.5.7.RELEASE; >= 1.6.10.RELEASE, < 1.6.11.RELEASE; >= 1.7.3.RELEASE, < 1.7.4.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-8045"
      },
      "impact_statement": "CVE-2017-8045 affects Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7 due to unsafe deserialization in Message.toString(). The target version 2.3.10-tuxcare.3 is not vulnerable because the fix (AMQP-766: allow-list for deserialization) was already present in the upstream Spring AMQP 2.3.10 release that TuxCare onboarded. The fix commit (36e55998f) was authored by upstream Spring maintainer Gary Russell and shipped in the upstream release before any TuxCare modifications. Later, CVE-2021-22095 prompted complete removal of deserialization, but for CVE-2017-8045 specifically, the allow-list approach was the official fix and was already present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.7; >= 1.6.0, < 1.6.11; >= 1.7.0, < 1.7.4), cve.org (< 1.7.4; = 1.6.11; = 1.5.7), Snyk (>= 1.5.6.RELEASE, < 1.5.7.RELEASE; >= 1.6.10.RELEASE, < 1.6.11.RELEASE; >= 1.7.3.RELEASE, < 1.7.4.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T01:27:53.972569+00:00",
      "status_notes": "Vulnerability CVE-2018-11087 does not affect version 2.3.10-tuxcare.1 of org.springframework.amqp:spring-amqp. not_affected \u2014 The target repository (Spring AMQP 2.3.10-tuxcare.3) is NOT vulnerable to CVE-2018-11087. The vulnerability (lack of hostname verification in SSL/TLS connections to RabbitMQ) was fixed by the upstream Spring AMQP team in commit 444b74e95 (AMQP-830), which introduced hostname verification enabled by default. This fix was included in upstream release v2.1.0.M3 and is present in version 2.3.10 tha...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11087"
      },
      "impact_statement": "not_affected \u2014 The target repository (Spring AMQP 2.3.10-tuxcare.3) is NOT vulnerable to CVE-2018-11087. The vulnerability (lack of hostname verification in SSL/TLS connections to RabbitMQ) was fixed by the upstream Spring AMQP team in commit 444b74e95 (AMQP-830), which introduced hostname verification enabled by default. This fix was included in upstream release v2.1.0.M3 and is present in version 2.3.10 tha..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T20:39:00.105531+00:00",
      "status_notes": "Vulnerability CVE-2021-22095 affects version 2.3.10-tuxcare.1 of org.springframework.amqp:spring-amqp, and is fixed in 2.3.10-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2021-22095"
      },
      "action_statement": "Vulnerability CVE-2021-22095 affects version 2.3.10-tuxcare.1 of org.springframework.amqp:spring-amqp, and is fixed in 2.3.10-tuxcare.3."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T14:45:00.197449+00:00",
      "status_notes": "Vulnerability CVE-2021-22097 is fixed in version 2.3.10-tuxcare.1 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2021-22097"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T14:44:00.151071+00:00",
      "status_notes": "Vulnerability CVE-2026-41701 affects version 2.3.10-tuxcare.1 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-41701"
      },
      "action_statement": "Vulnerability CVE-2026-41701 affects version 2.3.10-tuxcare.1 of org.springframework.amqp:spring-amqp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T14:44:00.151071+00:00",
      "status_notes": "Vulnerability CVE-2026-41714 affects version 2.3.10-tuxcare.1 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-41714"
      },
      "action_statement": "Vulnerability CVE-2026-41714 affects version 2.3.10-tuxcare.1 of org.springframework.amqp:spring-amqp."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T14:45:00.197449+00:00",
      "status_notes": "Vulnerability CVE-2026-47860 is fixed in version 2.3.10-tuxcare.1 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-47860"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T14:45:00.197449+00:00",
      "status_notes": "Vulnerability CVE-2026-59275 is fixed in version 2.3.10-tuxcare.1 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-59275"
      }
    }
  ]
}