{
  "@id": "urn:uuid:8e503f02-d445-4e49-a7d7-16beaab0626f",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 6,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-05T12:46:45.968557+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T12:09:00.012843+00:00",
      "status_notes": "Vulnerability CVE-2016-2173 does not affect version 2.4.10-tuxcare.1 of org.springframework.amqp:spring-amqp. CVE-2016-2173 affects Spring AMQP versions before 1.5.5, which lacked Java deserialization class validation, allowing arbitrary code execution through malicious serialized objects. The target version 2.4.10-tuxcare.1 is NOT vulnerable because it contains the upstream fix that was introduced in version 1.5.5 (March 2016) and evolved through version 2.1 (June 2020) when \"WhiteList\" terminology was changed to \"AllowedList\" for inclusive language. The defense mechanism (AllowedListDeserializingMessageConverter with pattern-based class validation) was already present in the upstream Spring AMQP 2.4.10 release that TuxCare onboarded, making this an upstream fix rather than a TuxCare backport.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-2173"
      },
      "impact_statement": "CVE-2016-2173 affects Spring AMQP versions before 1.5.5, which lacked Java deserialization class validation, allowing arbitrary code execution through malicious serialized objects. The target version 2.4.10-tuxcare.1 is NOT vulnerable because it contains the upstream fix that was introduced in version 1.5.5 (March 2016) and evolved through version 2.1 (June 2020) when \"WhiteList\" terminology was changed to \"AllowedList\" for inclusive language. The defense mechanism (AllowedListDeserializingMessageConverter with pattern-based class validation) was already present in the upstream Spring AMQP 2.4.10 release that TuxCare onboarded, making this an upstream fix rather than a TuxCare backport."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T12:46:45.968557+00:00",
      "status_notes": "Vulnerability CVE-2017-8045 does not affect version 2.4.10-tuxcare.1 of org.springframework.amqp:spring-amqp. CVE-2017-8045 affects Spring AMQP before 1.5.7, 1.6.0\u20131.6.10 and 1.7.0\u20131.7.3 (Spring advisory, NVD); it is fixed upstream in 1.5.7, 1.6.11 and 1.7.4. Version 2.4.10 is later than every fixed release and already contains the upstream fix, so the unsafe deserialization in Message.toString() is not present.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-8045"
      },
      "impact_statement": "CVE-2017-8045 affects Spring AMQP before 1.5.7, 1.6.0\u20131.6.10 and 1.7.0\u20131.7.3 (Spring advisory, NVD); it is fixed upstream in 1.5.7, 1.6.11 and 1.7.4. Version 2.4.10 is later than every fixed release and already contains the upstream fix, so the unsafe deserialization in Message.toString() is not present."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T08:57:20.982269+00:00",
      "status_notes": "Vulnerability CVE-2018-11087 does not affect version 2.4.10-tuxcare.1 of org.springframework.amqp:spring-amqp. not_affected \u2014 The target version 2.4.10-tuxcare.1 is not affected by CVE-2018-11087. The vulnerability (missing hostname verification in SSL/TLS connections to RabbitMQ) was fixed in upstream Spring AMQP version 2.0.6 by enabling hostname verification by default. The fix (commit 444b74e95) was already present in the upstream release 2.4.10 that TuxCare onboarded. The RabbitConnectionFactoryBean class in the ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11087"
      },
      "impact_statement": "not_affected \u2014 The target version 2.4.10-tuxcare.1 is not affected by CVE-2018-11087. The vulnerability (missing hostname verification in SSL/TLS connections to RabbitMQ) was fixed in upstream Spring AMQP version 2.0.6 by enabling hostname verification by default. The fix (commit 444b74e95) was already present in the upstream release 2.4.10 that TuxCare onboarded. The RabbitConnectionFactoryBean class in the ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T08:58:00.190535+00:00",
      "status_notes": "Vulnerability CVE-2021-22095 does not affect version 2.4.10-tuxcare.1 of org.springframework.amqp:spring-amqp. not_affected \u2014 Target version 2.4.10 is NOT AFFECTED by CVE-2021-22095. The vulnerability (unconditional String conversion in Message.toString() causing OOM with large message bodies) was already fixed in the upstream Spring AMQP 2.4.10 release by commit 4f3a1539d authored by Gary Russell (VMware). The fix adds a configurable size check (default 50 bytes) before converting message body to String, preventing O...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22095"
      },
      "impact_statement": "not_affected \u2014 Target version 2.4.10 is NOT AFFECTED by CVE-2021-22095. The vulnerability (unconditional String conversion in Message.toString() causing OOM with large message bodies) was already fixed in the upstream Spring AMQP 2.4.10 release by commit 4f3a1539d authored by Gary Russell (VMware). The fix adds a configurable size check (default 50 bytes) before converting message body to String, preventing O..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T08:57:00.153828+00:00",
      "status_notes": "Vulnerability CVE-2021-22097 does not affect version 2.4.10-tuxcare.1 of org.springframework.amqp:spring-amqp. not_affected \u2014 CVE-2021-22097 affects Spring AMQP versions 2.2.0-2.2.18 and 2.3.0-2.3.10. The target version 2.4.10 is above these ranges and already contains the upstream fix (commit ed824637c) that was shipped in the original Spring AMQP 2.4.10 release. The vulnerable deserialization code in Message.toString() has been replaced with a static string \"[serialized object]\" at lines 129-130 of Message.java.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22097"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22097 affects Spring AMQP versions 2.2.0-2.2.18 and 2.3.0-2.3.10. The target version 2.4.10 is above these ranges and already contains the upstream fix (commit ed824637c) that was shipped in the original Spring AMQP 2.4.10 release. The vulnerable deserialization code in Message.toString() has been replaced with a static string \"[serialized object]\" at lines 129-130 of Message.java."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T05:56:00.107493+00:00",
      "status_notes": "Vulnerability CVE-2026-41701 affects version 2.4.10-tuxcare.1 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-41701"
      },
      "action_statement": "Vulnerability CVE-2026-41701 affects version 2.4.10-tuxcare.1 of org.springframework.amqp:spring-amqp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T05:56:00.107493+00:00",
      "status_notes": "Vulnerability CVE-2026-41714 affects version 2.4.10-tuxcare.1 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-41714"
      },
      "action_statement": "Vulnerability CVE-2026-41714 affects version 2.4.10-tuxcare.1 of org.springframework.amqp:spring-amqp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T05:56:00.107493+00:00",
      "status_notes": "Vulnerability CVE-2026-47860 affects version 2.4.10-tuxcare.1 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-47860"
      },
      "action_statement": "Vulnerability CVE-2026-47860 affects version 2.4.10-tuxcare.1 of org.springframework.amqp:spring-amqp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T05:56:00.107493+00:00",
      "status_notes": "Vulnerability CVE-2026-59275 affects version 2.4.10-tuxcare.1 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-59275"
      },
      "action_statement": "Vulnerability CVE-2026-59275 affects version 2.4.10-tuxcare.1 of org.springframework.amqp:spring-amqp."
    }
  ]
}