{
  "@id": "urn:uuid:2fde1eb0-48c1-481b-b688-cee509d97296",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 9,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:05:53.304095+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.16-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.16-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:04:11.456857+00:00",
      "status_notes": "Vulnerability CVE-2016-2173 does not affect version 2.3.16-tuxcare.2 of org.springframework.amqp:spring-amqp. CVE-2016-2173 affects Spring AMQP versions before 1.5.5. The target version 2.3.16-tuxcare.3 contains the upstream fix introduced in 1.5.5 via the AllowedListDeserializingMessageConverter class and checkAllowedList mechanism. This defense was authored by upstream Spring (grussell@pivotal.io) in commit 462dcb6f1f93d54923daffb9729c1c8519576c08 and was already present in the upstream 2.3.16 release when TuxCare onboarded it. The vulnerable code pattern (unsafe deserialization without validation) is not present; it was replaced by code with an allowed-list validation mechanism.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.5), Snyk (< 1.5.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-2173"
      },
      "impact_statement": "CVE-2016-2173 affects Spring AMQP versions before 1.5.5. The target version 2.3.16-tuxcare.3 contains the upstream fix introduced in 1.5.5 via the AllowedListDeserializingMessageConverter class and checkAllowedList mechanism. This defense was authored by upstream Spring (grussell@pivotal.io) in commit 462dcb6f1f93d54923daffb9729c1c8519576c08 and was already present in the upstream 2.3.16 release when TuxCare onboarded it. The vulnerable code pattern (unsafe deserialization without validation) is not present; it was replaced by code with an allowed-list validation mechanism.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.5), Snyk (< 1.5.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.16-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.16-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2017-8045 does not affect version 2.3.16-tuxcare.2 of org.springframework.amqp:spring-amqp. CVE-2017-8045 affects Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7 due to unsafe deserialization in org.springframework.amqp.core.Message.toString(). The target version 2.3.16 is NOT affected because an upstream fix (commit 2463f92a9e) was already shipped in the upstream release. The fix replaced the vulnerable SerializationUtils.deserialize() call in toString() with a safe string return \"[serialized object]\", eliminating the RCE attack vector. This is an upstream fix by Gary Russell (VMware), not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.7; >= 1.6.0, < 1.6.11; >= 1.7.0, < 1.7.4), cve.org (< 1.7.4; = 1.6.11; = 1.5.7), Snyk (>= 1.5.6.RELEASE, < 1.5.7.RELEASE; >= 1.6.10.RELEASE, < 1.6.11.RELEASE; >= 1.7.3.RELEASE, < 1.7.4.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-8045"
      },
      "impact_statement": "CVE-2017-8045 affects Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7 due to unsafe deserialization in org.springframework.amqp.core.Message.toString(). The target version 2.3.16 is NOT affected because an upstream fix (commit 2463f92a9e) was already shipped in the upstream release. The fix replaced the vulnerable SerializationUtils.deserialize() call in toString() with a safe string return \"[serialized object]\", eliminating the RCE attack vector. This is an upstream fix by Gary Russell (VMware), not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.7; >= 1.6.0, < 1.6.11; >= 1.7.0, < 1.7.4), cve.org (< 1.7.4; = 1.6.11; = 1.5.7), Snyk (>= 1.5.6.RELEASE, < 1.5.7.RELEASE; >= 1.6.10.RELEASE, < 1.6.11.RELEASE; >= 1.7.3.RELEASE, < 1.7.4.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.16-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.16-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T01:26:39.724365+00:00",
      "status_notes": "Vulnerability CVE-2018-11087 does not affect version 2.3.16-tuxcare.2 of org.springframework.amqp:spring-amqp. not_affected \u2014 CVE-2018-11087 affects Spring AMQP versions 1.x < 1.7.10 and 2.x < 2.0.6 due to lack of hostname verification in TLS connections, allowing man-in-the-middle attacks. The target version 2.3.16-tuxcare.3 is not affected because the upstream vendor (Pivotal/Spring) already fixed this vulnerability before the 2.3.16 release. The fix enables hostname verification by default (enableHostnameVerificati...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11087"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-11087 affects Spring AMQP versions 1.x < 1.7.10 and 2.x < 2.0.6 due to lack of hostname verification in TLS connections, allowing man-in-the-middle attacks. The target version 2.3.16-tuxcare.3 is not affected because the upstream vendor (Pivotal/Spring) already fixed this vulnerability before the 2.3.16 release. The fix enables hostname verification by default (enableHostnameVerificati..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.16-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.16-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T05:04:00.209412+00:00",
      "status_notes": "Vulnerability CVE-2021-22095 does not affect version 2.3.16-tuxcare.2 of org.springframework.amqp:spring-amqp. not_affected \u2014 Spring AMQP 2.3.16 is NOT affected by CVE-2021-22095. The vulnerability (unbounded String allocation in Message.toString() causing OOM errors) was fixed in the upstream release before TuxCare onboarded it. The fix (commit b881b6515 by Gary Russell) added a maxBodyLength check (default 50 bytes) that prevents converting large message bodies to String. CVE-2021-22095 affects versions 2.2.0-2.2.19...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22095"
      },
      "impact_statement": "not_affected \u2014 Spring AMQP 2.3.16 is NOT affected by CVE-2021-22095. The vulnerability (unbounded String allocation in Message.toString() causing OOM errors) was fixed in the upstream release before TuxCare onboarded it. The fix (commit b881b6515 by Gary Russell) added a maxBodyLength check (default 50 bytes) that prevents converting large message bodies to String. CVE-2021-22095 affects versions 2.2.0-2.2.19..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.16-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.16-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T05:04:00.209412+00:00",
      "status_notes": "Vulnerability CVE-2021-22097 does not affect version 2.3.16-tuxcare.2 of org.springframework.amqp:spring-amqp. not_affected \u2014 CVE-2021-22097 is not present in Spring AMQP 2.3.16-tuxcare.3. The vulnerable deserialization code in Message.toString() was fixed by upstream Spring AMQP in commit 2463f92a9 (Sept 2021) and shipped in the upstream 2.3.16 release. The target returns \"[serialized object]\" instead of deserializing, preventing the CPU exhaustion attack. TuxCare onboarded this already-fixed version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22097"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22097 is not present in Spring AMQP 2.3.16-tuxcare.3. The vulnerable deserialization code in Message.toString() was fixed by upstream Spring AMQP in commit 2463f92a9 (Sept 2021) and shipped in the upstream 2.3.16 release. The target returns \"[serialized object]\" instead of deserializing, preventing the CPU exhaustion attack. TuxCare onboarded this already-fixed version."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.16-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.16-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-15T15:04:00.820733+00:00",
      "status_notes": "Vulnerability CVE-2026-41701 affects version 2.3.16-tuxcare.2 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-41701"
      },
      "action_statement": "Vulnerability CVE-2026-41701 affects version 2.3.16-tuxcare.2 of org.springframework.amqp:spring-amqp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.16-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.16-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-15T15:04:00.820733+00:00",
      "status_notes": "Vulnerability CVE-2026-41714 affects version 2.3.16-tuxcare.2 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-41714"
      },
      "action_statement": "Vulnerability CVE-2026-41714 affects version 2.3.16-tuxcare.2 of org.springframework.amqp:spring-amqp."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.16-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.16-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-15T15:05:32.357543+00:00",
      "status_notes": "Vulnerability CVE-2026-47860 is fixed in version 2.3.16-tuxcare.2 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-47860"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.16-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.16-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-15T15:05:32.357543+00:00",
      "status_notes": "Vulnerability CVE-2026-59275 is fixed in version 2.3.16-tuxcare.2 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-59275"
      }
    }
  ]
}