{
  "@id": "urn:uuid:613556b6-25f3-4f68-8052-cb85a6c464a4",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 6,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:05:53.304095+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:03:00.104314+00:00",
      "status_notes": "Vulnerability CVE-2016-2173 does not affect version 2.3.7-tuxcare.4 of org.springframework.amqp:spring-amqp. Spring AMQP version 2.3.7-tuxcare.5 is NOT affected by CVE-2016-2173. The vulnerability (unsafe Java deserialization allowing remote code execution) was fixed in upstream Spring AMQP v1.5.5 (March 2016) via commit 4150f107e by Gary Russell. The fix introduced AllowedListDeserializingMessageConverter which validates all classes against a configurable allowlist before deserialization, throwing SecurityException for unauthorized classes. Version 2.3.7 (released 2020) includes this defense. The fix was shipped in the upstream release that TuxCare onboarded, not added by TuxCare as a backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.5), Snyk (< 1.5.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-2173"
      },
      "impact_statement": "Spring AMQP version 2.3.7-tuxcare.5 is NOT affected by CVE-2016-2173. The vulnerability (unsafe Java deserialization allowing remote code execution) was fixed in upstream Spring AMQP v1.5.5 (March 2016) via commit 4150f107e by Gary Russell. The fix introduced AllowedListDeserializingMessageConverter which validates all classes against a configurable allowlist before deserialization, throwing SecurityException for unauthorized classes. Version 2.3.7 (released 2020) includes this defense. The fix was shipped in the upstream release that TuxCare onboarded, not added by TuxCare as a backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.5), Snyk (< 1.5.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2017-8045 does not affect version 2.3.7-tuxcare.4 of org.springframework.amqp:spring-amqp. CVE-2017-8045 affects Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7 (released in 2017). The target version 2.3.7-tuxcare.5 is significantly newer and already contains the upstream fix. The official Spring fix (AMQP-766, commit 36e55998f by Gary Russell in September 2017) added whitelisting to prevent unsafe deserialization in Message.toString(). This fix was already present in the upstream 2.3.7 release when TuxCare onboarded it. The vulnerable unsafe deserialization code is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.7; >= 1.6.0, < 1.6.11; >= 1.7.0, < 1.7.4), cve.org (< 1.7.4; = 1.6.11; = 1.5.7), Snyk (>= 1.5.6.RELEASE, < 1.5.7.RELEASE; >= 1.6.10.RELEASE, < 1.6.11.RELEASE; >= 1.7.3.RELEASE, < 1.7.4.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-8045"
      },
      "impact_statement": "CVE-2017-8045 affects Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7 (released in 2017). The target version 2.3.7-tuxcare.5 is significantly newer and already contains the upstream fix. The official Spring fix (AMQP-766, commit 36e55998f by Gary Russell in September 2017) added whitelisting to prevent unsafe deserialization in Message.toString(). This fix was already present in the upstream 2.3.7 release when TuxCare onboarded it. The vulnerable unsafe deserialization code is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.7; >= 1.6.0, < 1.6.11; >= 1.7.0, < 1.7.4), cve.org (< 1.7.4; = 1.6.11; = 1.5.7), Snyk (>= 1.5.6.RELEASE, < 1.5.7.RELEASE; >= 1.6.10.RELEASE, < 1.6.11.RELEASE; >= 1.7.3.RELEASE, < 1.7.4.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-23T11:01:49.503620+00:00",
      "status_notes": "Vulnerability CVE-2018-11087 does not affect version 2.3.7-tuxcare.4 of org.springframework.amqp:spring-amqp. Spring Amqp 2.3.7 is not vulnerable as it is outside the affected ranges: [0, 1.7.10), [2.0.0, 2.0.6)",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11087"
      },
      "impact_statement": "Spring Amqp 2.3.7 is not vulnerable as it is outside the affected ranges: [0, 1.7.10), [2.0.0, 2.0.6)"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-27T20:34:02.646830+00:00",
      "status_notes": "Vulnerability CVE-2021-22095 affects version 2.3.7-tuxcare.4 of org.springframework.amqp:spring-amqp, and is fixed in 2.3.7-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2021-22095"
      },
      "action_statement": "Vulnerability CVE-2021-22095 affects version 2.3.7-tuxcare.4 of org.springframework.amqp:spring-amqp, and is fixed in 2.3.7-tuxcare.5."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-23T07:31:00.305742+00:00",
      "status_notes": "Vulnerability CVE-2021-22097 is fixed in version 2.3.7-tuxcare.4 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2021-22097"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-23T07:31:00.305742+00:00",
      "status_notes": "Vulnerability CVE-2023-34050 affects version 2.3.7-tuxcare.4 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2023-34050"
      },
      "action_statement": "Vulnerability CVE-2023-34050 affects version 2.3.7-tuxcare.4 of org.springframework.amqp:spring-amqp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-23T07:31:00.305742+00:00",
      "status_notes": "Vulnerability CVE-2026-41701 affects version 2.3.7-tuxcare.4 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-41701"
      },
      "action_statement": "Vulnerability CVE-2026-41701 affects version 2.3.7-tuxcare.4 of org.springframework.amqp:spring-amqp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-23T07:31:00.305742+00:00",
      "status_notes": "Vulnerability CVE-2026-41714 affects version 2.3.7-tuxcare.4 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-41714"
      },
      "action_statement": "Vulnerability CVE-2026-41714 affects version 2.3.7-tuxcare.4 of org.springframework.amqp:spring-amqp."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-23T07:31:00.305742+00:00",
      "status_notes": "Vulnerability CVE-2026-47860 is fixed in version 2.3.7-tuxcare.4 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-47860"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.3.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-23T07:31:00.305742+00:00",
      "status_notes": "Vulnerability CVE-2026-59275 is fixed in version 2.3.7-tuxcare.4 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-59275"
      }
    }
  ]
}