{
  "@id": "urn:uuid:13b5ba45-314f-4196-9abc-83ebba43d341",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 8,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:05:53.304095+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:04:11.456857+00:00",
      "status_notes": "Vulnerability CVE-2016-2173 does not affect version 2.4.16-tuxcare.3 of org.springframework.amqp:spring-amqp. CVE-2016-2173 affects Spring AMQP before version 1.5.5 due to unrestricted Java deserialization in DefaultDeserializer. The target version 2.4.16-tuxcare.5 includes the upstream fix (commit 462dcb6f1, March 2016) that introduced the AllowedListDeserializingMessageConverter framework with checkAllowedList() validation. The defense mechanism exists in the code but requires explicit configuration of whitelist patterns to be active (defaults to empty, allowing all classes). Since the CVE specifically addresses the complete absence of any defense mechanism (pre-1.5.5), and version 2.4.16 includes the defense framework capability, the vulnerability is resolved. This is an upstream vendor fix authored by Gary Russell (grussell@pivotal.io) that was already present in the 2.4.16 release when TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.5), Snyk (< 1.5.5).",
      "vulnerability": {
        "name": "CVE-2016-2173"
      },
      "impact_statement": "CVE-2016-2173 affects Spring AMQP before version 1.5.5 due to unrestricted Java deserialization in DefaultDeserializer. The target version 2.4.16-tuxcare.5 includes the upstream fix (commit 462dcb6f1, March 2016) that introduced the AllowedListDeserializingMessageConverter framework with checkAllowedList() validation. The defense mechanism exists in the code but requires explicit configuration of whitelist patterns to be active (defaults to empty, allowing all classes). Since the CVE specifically addresses the complete absence of any defense mechanism (pre-1.5.5), and version 2.4.16 includes the defense framework capability, the vulnerability is resolved. This is an upstream vendor fix authored by Gary Russell (grussell@pivotal.io) that was already present in the 2.4.16 release when TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.5), Snyk (< 1.5.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2017-8045 does not affect version 2.4.16-tuxcare.3 of org.springframework.amqp:spring-amqp. Spring AMQP version 2.4.16 is not affected by CVE-2017-8045. The vulnerability involved unsafe deserialization of serialized Java objects when Message.toString() was called, potentially allowing remote code execution via malicious payloads. This was fixed by upstream author Gary Russell in commit 36e55998f (Sep 2017) by adding whitelist-based deserialization, and further improved in commit ed824637c (Sep 2021) by completely eliminating deserialization from toString(). Both fixes were already present in the upstream 2.4.16 release that TuxCare onboarded, so the vulnerable code pattern never existed in this TuxCare-maintained version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.7; >= 1.6.0, < 1.6.11; >= 1.7.0, < 1.7.4), cve.org (< 1.7.4; = 1.6.11; = 1.5.7), Snyk (>= 1.5.6.RELEASE, < 1.5.7.RELEASE; >= 1.6.10.RELEASE, < 1.6.11.RELEASE; >= 1.7.3.RELEASE, < 1.7.4.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-8045"
      },
      "impact_statement": "Spring AMQP version 2.4.16 is not affected by CVE-2017-8045. The vulnerability involved unsafe deserialization of serialized Java objects when Message.toString() was called, potentially allowing remote code execution via malicious payloads. This was fixed by upstream author Gary Russell in commit 36e55998f (Sep 2017) by adding whitelist-based deserialization, and further improved in commit ed824637c (Sep 2021) by completely eliminating deserialization from toString(). Both fixes were already present in the upstream 2.4.16 release that TuxCare onboarded, so the vulnerable code pattern never existed in this TuxCare-maintained version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.7; >= 1.6.0, < 1.6.11; >= 1.7.0, < 1.7.4), cve.org (< 1.7.4; = 1.6.11; = 1.5.7), Snyk (>= 1.5.6.RELEASE, < 1.5.7.RELEASE; >= 1.6.10.RELEASE, < 1.6.11.RELEASE; >= 1.7.3.RELEASE, < 1.7.4.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-23T11:01:49.503620+00:00",
      "status_notes": "Vulnerability CVE-2018-11087 does not affect version 2.4.16-tuxcare.3 of org.springframework.amqp:spring-amqp. Spring Amqp 2.4.16 is not vulnerable as it is outside the affected ranges: [0, 1.7.10), [2.0.0, 2.0.6)",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11087"
      },
      "impact_statement": "Spring Amqp 2.4.16 is not vulnerable as it is outside the affected ranges: [0, 1.7.10), [2.0.0, 2.0.6)"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T05:01:45.788222+00:00",
      "status_notes": "Vulnerability CVE-2021-22095 does not affect version 2.4.16-tuxcare.3 of org.springframework.amqp:spring-amqp. not_affected \u2014 CVE-2021-22095 (OOM error from unconditional String conversion of large message bodies in toString()) is NOT present in spring-amqp 2.4.16-tuxcare.4. The fix was already included in the upstream 2.4.16 release that TuxCare onboarded. Fix commit 4f3a1539da2dddb5f179b53cbb7f46e89a45632e by upstream author Gary Russell (grussell@vmware.com) adds a size limit check (maxBodyLength=50 default) that p...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22095"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22095 (OOM error from unconditional String conversion of large message bodies in toString()) is NOT present in spring-amqp 2.4.16-tuxcare.4. The fix was already included in the upstream 2.4.16 release that TuxCare onboarded. Fix commit 4f3a1539da2dddb5f179b53cbb7f46e89a45632e by upstream author Gary Russell (grussell@vmware.com) adds a size limit check (maxBodyLength=50 default) that p..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T05:05:00.060068+00:00",
      "status_notes": "Vulnerability CVE-2021-22097 does not affect version 2.4.16-tuxcare.3 of org.springframework.amqp:spring-amqp. not_affected \u2014 CVE-2021-22097 is not present in spring-amqp 2.4.16-tuxcare.4. The upstream Spring AMQP project fixed this vulnerability before releasing version 2.4.16. The fix (commit ed824637cc by Gary Russell) eliminated deserialization in the Message.toString() method, replacing it with a constant string \"[serialized object]\". This upstream fix was already present when TuxCare onboarded version 2.4.16, so...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22097"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22097 is not present in spring-amqp 2.4.16-tuxcare.4. The upstream Spring AMQP project fixed this vulnerability before releasing version 2.4.16. The fix (commit ed824637cc by Gary Russell) eliminated deserialization in the Message.toString() method, replacing it with a constant string \"[serialized object]\". This upstream fix was already present when TuxCare onboarded version 2.4.16, so..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-23T08:15:15.814278+00:00",
      "status_notes": "Vulnerability CVE-2026-41701 affects version 2.4.16-tuxcare.3 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-41701"
      },
      "action_statement": "Vulnerability CVE-2026-41701 affects version 2.4.16-tuxcare.3 of org.springframework.amqp:spring-amqp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-23T08:15:15.814278+00:00",
      "status_notes": "Vulnerability CVE-2026-41714 affects version 2.4.16-tuxcare.3 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-41714"
      },
      "action_statement": "Vulnerability CVE-2026-41714 affects version 2.4.16-tuxcare.3 of org.springframework.amqp:spring-amqp."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-23T08:15:15.814278+00:00",
      "status_notes": "Vulnerability CVE-2026-47860 is fixed in version 2.4.16-tuxcare.3 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-47860"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.16-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.16-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-23T08:15:15.814278+00:00",
      "status_notes": "Vulnerability CVE-2026-59275 is fixed in version 2.4.16-tuxcare.3 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-59275"
      }
    }
  ]
}