{
  "@id": "urn:uuid:21265a8a-8399-4fa9-81dd-795a5b3bbf0f",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 5,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:05:53.304095+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:04:11.456857+00:00",
      "status_notes": "Vulnerability CVE-2016-2173 does not affect version 2.3.6-tuxcare.2 of org.springframework.amqp:spring-amqp. CVE-2016-2173 affects Spring AMQP before version 1.5.5 due to unsafe Java deserialization with DefaultDeserializer allowing arbitrary code execution. The target version 2.3.6 includes the upstream fix (allowlist mechanism via AllowedListDeserializingMessageConverter) introduced in version 1.5.5. However, the fix is opt-in: by default the allowlist is empty, meaning all classes can be deserialized. Applications must explicitly configure allowedListPatterns to enable protection against deserialization attacks on untrusted input. This disable-by-default strategy is the vendor's chosen fix approach, as documented in the Spring AMQP reference guide.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.5), Snyk (< 1.5.5).",
      "vulnerability": {
        "name": "CVE-2016-2173"
      },
      "impact_statement": "CVE-2016-2173 affects Spring AMQP before version 1.5.5 due to unsafe Java deserialization with DefaultDeserializer allowing arbitrary code execution. The target version 2.3.6 includes the upstream fix (allowlist mechanism via AllowedListDeserializingMessageConverter) introduced in version 1.5.5. However, the fix is opt-in: by default the allowlist is empty, meaning all classes can be deserialized. Applications must explicitly configure allowedListPatterns to enable protection against deserialization attacks on untrusted input. This disable-by-default strategy is the vendor's chosen fix approach, as documented in the Spring AMQP reference guide.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.5), Snyk (< 1.5.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2017-8045 does not affect version 2.3.6-tuxcare.2 of org.springframework.amqp:spring-amqp. CVE-2017-8045 affects Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7, where Message.toString() performed unsafe deserialization of serialized Java objects. The target version 2.3.6-tuxcare.3 is not affected because the upstream fix (AMQP-766, commit 36e55998f) was already included in Spring AMQP 2.3.6 when TuxCare onboarded it. The vulnerable deserialization pattern is not present. The fix was authored by upstream Pivotal/VMware engineers, not TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.7; >= 1.6.0, < 1.6.11; >= 1.7.0, < 1.7.4), cve.org (< 1.7.4; = 1.6.11; = 1.5.7), Snyk (>= 1.5.6.RELEASE, < 1.5.7.RELEASE; >= 1.6.10.RELEASE, < 1.6.11.RELEASE; >= 1.7.3.RELEASE, < 1.7.4.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-8045"
      },
      "impact_statement": "CVE-2017-8045 affects Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7, where Message.toString() performed unsafe deserialization of serialized Java objects. The target version 2.3.6-tuxcare.3 is not affected because the upstream fix (AMQP-766, commit 36e55998f) was already included in Spring AMQP 2.3.6 when TuxCare onboarded it. The vulnerable deserialization pattern is not present. The fix was authored by upstream Pivotal/VMware engineers, not TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.7; >= 1.6.0, < 1.6.11; >= 1.7.0, < 1.7.4), cve.org (< 1.7.4; = 1.6.11; = 1.5.7), Snyk (>= 1.5.6.RELEASE, < 1.5.7.RELEASE; >= 1.6.10.RELEASE, < 1.6.11.RELEASE; >= 1.7.3.RELEASE, < 1.7.4.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-23T08:27:20.285527+00:00",
      "status_notes": "Vulnerability CVE-2018-11087 does not affect version 2.3.6-tuxcare.2 of org.springframework.amqp:spring-amqp. not_affected \u2014 The target Spring AMQP version 2.3.6 is NOT vulnerable to CVE-2018-11087. The upstream vendor (Pivotal/Spring) already fixed this man-in-the-middle vulnerability in version 2.0.6 by enabling hostname verification by default. The fix (commit 444b74e95 by Gary Russell <grussell@pivotal.io>) is present in the target: enableHostnameVerification defaults to true (line 158), and connectionFactory.ena...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11087"
      },
      "impact_statement": "not_affected \u2014 The target Spring AMQP version 2.3.6 is NOT vulnerable to CVE-2018-11087. The upstream vendor (Pivotal/Spring) already fixed this man-in-the-middle vulnerability in version 2.0.6 by enabling hostname verification by default. The fix (commit 444b74e95 by Gary Russell <grussell@pivotal.io>) is present in the target: enableHostnameVerification defaults to true (line 158), and connectionFactory.ena..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T20:44:03.580940+00:00",
      "status_notes": "Vulnerability CVE-2021-22095 affects version 2.3.6-tuxcare.2 of org.springframework.amqp:spring-amqp, and is fixed in 2.3.6-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2021-22095"
      },
      "action_statement": "Vulnerability CVE-2021-22095 affects version 2.3.6-tuxcare.2 of org.springframework.amqp:spring-amqp, and is fixed in 2.3.6-tuxcare.3."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-23T08:27:20.285527+00:00",
      "status_notes": "Vulnerability CVE-2021-22097 is fixed in version 2.3.6-tuxcare.2 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2021-22097"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-23T08:27:20.285527+00:00",
      "status_notes": "Vulnerability CVE-2023-34050 affects version 2.3.6-tuxcare.2 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2023-34050"
      },
      "action_statement": "Vulnerability CVE-2023-34050 affects version 2.3.6-tuxcare.2 of org.springframework.amqp:spring-amqp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-23T08:27:20.285527+00:00",
      "status_notes": "Vulnerability CVE-2026-41701 affects version 2.3.6-tuxcare.2 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-41701"
      },
      "action_statement": "Vulnerability CVE-2026-41701 affects version 2.3.6-tuxcare.2 of org.springframework.amqp:spring-amqp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-23T08:27:20.285527+00:00",
      "status_notes": "Vulnerability CVE-2026-41714 affects version 2.3.6-tuxcare.2 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-41714"
      },
      "action_statement": "Vulnerability CVE-2026-41714 affects version 2.3.6-tuxcare.2 of org.springframework.amqp:spring-amqp."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-23T08:27:20.285527+00:00",
      "status_notes": "Vulnerability CVE-2026-47860 is fixed in version 2.3.6-tuxcare.2 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-47860"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-23T08:27:20.285527+00:00",
      "status_notes": "Vulnerability CVE-2026-59275 is fixed in version 2.3.6-tuxcare.2 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-59275"
      }
    }
  ]
}