{
  "@id": "urn:uuid:742ea407-860e-4469-af8c-725a91aa1c3e",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 9,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:04:11.456857+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:02:00.202619+00:00",
      "status_notes": "Vulnerability CVE-2016-2173 does not affect version 2.4.12-tuxcare.2 of org.springframework.amqp:spring-amqp. CVE-2016-2173 affects Spring AMQP before 1.5.5 due to unrestricted Java deserialization in DefaultDeserializer allowing remote code execution. The target version 2.4.12-tuxcare.3 contains the upstream fix (commit 462dcb6f, AMQP-590) introduced in version 1.5.5 by Gary Russell. The fix adds an allowlist-based deserialization restriction mechanism via AllowedListDeserializingMessageConverter base class, with SerializerMessageConverter and SimpleMessageConverter overriding resolveClass() to call checkAllowedList() before allowing class instantiation. The defense mechanism is present but requires configuration (non-empty allowlist patterns) to be effective, as it defaults to an empty allowlist. This is an upstream vendor fix that shipped in release 2.4.12 before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.5), Snyk (< 1.5.5).",
      "vulnerability": {
        "name": "CVE-2016-2173"
      },
      "impact_statement": "CVE-2016-2173 affects Spring AMQP before 1.5.5 due to unrestricted Java deserialization in DefaultDeserializer allowing remote code execution. The target version 2.4.12-tuxcare.3 contains the upstream fix (commit 462dcb6f, AMQP-590) introduced in version 1.5.5 by Gary Russell. The fix adds an allowlist-based deserialization restriction mechanism via AllowedListDeserializingMessageConverter base class, with SerializerMessageConverter and SimpleMessageConverter overriding resolveClass() to call checkAllowedList() before allowing class instantiation. The defense mechanism is present but requires configuration (non-empty allowlist patterns) to be effective, as it defaults to an empty allowlist. This is an upstream vendor fix that shipped in release 2.4.12 before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.5), Snyk (< 1.5.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:04:11.456857+00:00",
      "status_notes": "Vulnerability CVE-2017-8045 does not affect version 2.4.12-tuxcare.2 of org.springframework.amqp:spring-amqp. CVE-2017-8045 is NOT present in Spring AMQP 2.4.12-tuxcare.3. The vulnerability involved unsafe deserialization in Message.toString() that could lead to remote code execution. The upstream vendor (VMware/Pivotal) fixed this in 2021 by completely removing deserialization from the toString() method - it now simply returns \"[serialized object]\" for serialized content types. This fix (commit ed824637c by Gary Russell) was already present in the upstream 2.4.12 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.7; >= 1.6.0, < 1.6.11; >= 1.7.0, < 1.7.4), cve.org (< 1.7.4; = 1.6.11; = 1.5.7), Snyk (>= 1.5.6.RELEASE, < 1.5.7.RELEASE; >= 1.6.10.RELEASE, < 1.6.11.RELEASE; >= 1.7.3.RELEASE, < 1.7.4.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-8045"
      },
      "impact_statement": "CVE-2017-8045 is NOT present in Spring AMQP 2.4.12-tuxcare.3. The vulnerability involved unsafe deserialization in Message.toString() that could lead to remote code execution. The upstream vendor (VMware/Pivotal) fixed this in 2021 by completely removing deserialization from the toString() method - it now simply returns \"[serialized object]\" for serialized content types. This fix (commit ed824637c by Gary Russell) was already present in the upstream 2.4.12 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.7; >= 1.6.0, < 1.6.11; >= 1.7.0, < 1.7.4), cve.org (< 1.7.4; = 1.6.11; = 1.5.7), Snyk (>= 1.5.6.RELEASE, < 1.5.7.RELEASE; >= 1.6.10.RELEASE, < 1.6.11.RELEASE; >= 1.7.3.RELEASE, < 1.7.4.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-23T11:01:49.503620+00:00",
      "status_notes": "Vulnerability CVE-2018-11087 does not affect version 2.4.12-tuxcare.2 of org.springframework.amqp:spring-amqp. Spring Amqp 2.4.12 is not vulnerable as it is outside the affected ranges: [0, 1.7.10), [2.0.0, 2.0.6)",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11087"
      },
      "impact_statement": "Spring Amqp 2.4.12 is not vulnerable as it is outside the affected ranges: [0, 1.7.10), [2.0.0, 2.0.6)"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T05:01:45.788222+00:00",
      "status_notes": "Vulnerability CVE-2021-22095 does not affect version 2.4.12-tuxcare.2 of org.springframework.amqp:spring-amqp. not_affected \u2014 CVE-2021-22095 is NOT present in spring-amqp 2.4.12. The vulnerability (unconditional String allocation from large message bodies causing OOM in Message.toString()) was fixed in the upstream release. The fix (maxBodyLength size check) is present at lines 46, 50, 98-106, and 133-138 of Message.java. This fix was authored by Gary Russell (grussell@vmware.com) on Nov 10, 2021 and shipped in the up...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22095"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22095 is NOT present in spring-amqp 2.4.12. The vulnerability (unconditional String allocation from large message bodies causing OOM in Message.toString()) was fixed in the upstream release. The fix (maxBodyLength size check) is present at lines 46, 50, 98-106, and 133-138 of Message.java. This fix was authored by Gary Russell (grussell@vmware.com) on Nov 10, 2021 and shipped in the up..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T05:04:00.209412+00:00",
      "status_notes": "Vulnerability CVE-2021-22097 does not affect version 2.4.12-tuxcare.2 of org.springframework.amqp:spring-amqp. not_affected \u2014 CVE-2021-22097 is NOT present in Spring AMQP 2.4.12. The vulnerability involved Message.toString() deserializing Java objects with content type application/x-java-serialized-object, enabling CPU exhaustion attacks via malicious java.util.Dictionary objects. The upstream fix (commit ed824637c by Gary Russell, Sept 2021) removed deserialization from toString(), returning the literal string \"[seri...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22097"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22097 is NOT present in Spring AMQP 2.4.12. The vulnerability involved Message.toString() deserializing Java objects with content type application/x-java-serialized-object, enabling CPU exhaustion attacks via malicious java.util.Dictionary objects. The upstream fix (commit ed824637c by Gary Russell, Sept 2021) removed deserialization from toString(), returning the literal string \"[seri..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-15T15:02:09.634987+00:00",
      "status_notes": "Vulnerability CVE-2023-34050 affects version 2.4.12-tuxcare.2 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2023-34050"
      },
      "action_statement": "Vulnerability CVE-2023-34050 affects version 2.4.12-tuxcare.2 of org.springframework.amqp:spring-amqp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-15T15:02:09.634987+00:00",
      "status_notes": "Vulnerability CVE-2026-41701 affects version 2.4.12-tuxcare.2 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-41701"
      },
      "action_statement": "Vulnerability CVE-2026-41701 affects version 2.4.12-tuxcare.2 of org.springframework.amqp:spring-amqp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-15T15:02:09.634987+00:00",
      "status_notes": "Vulnerability CVE-2026-41714 affects version 2.4.12-tuxcare.2 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-41714"
      },
      "action_statement": "Vulnerability CVE-2026-41714 affects version 2.4.12-tuxcare.2 of org.springframework.amqp:spring-amqp."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-15T15:02:55.309686+00:00",
      "status_notes": "Vulnerability CVE-2026-47860 is fixed in version 2.4.12-tuxcare.2 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-47860"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-15T15:02:55.309686+00:00",
      "status_notes": "Vulnerability CVE-2026-59275 is fixed in version 2.4.12-tuxcare.2 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-59275"
      }
    }
  ]
}