{
  "@id": "urn:uuid:d80366ac-0f0b-4d9a-ab16-aae19a0dc948",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-08T22:15:16.108718+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T10:55:31.258093+00:00",
      "status_notes": "Vulnerability CVE-2016-2173 does not affect version 2.4.5-tuxcare.1 of org.springframework.amqp:spring-amqp. CVE-2016-2173 affects Spring AMQP before version 1.5.5 due to unsafe Java deserialization in DefaultDeserializer. The target repository is Spring AMQP version 2.4.5, which contains the upstream fix introduced in commit 462dcb6f1 (AMQP-590). The fix adds an allowlist-based deserialization filter infrastructure via AllowedListDeserializingMessageConverter and checkAllowedList() mechanism. However, by default the allowlist is empty (permitting all classes), requiring explicit configuration via setAllowedListPatterns() for protection. This disable-by-default strategy was the vendor's intentional fix approach. Since the fix was authored by upstream Spring AMQP maintainers (not TuxCare) and shipped in the upstream 2.4.5 release, the verdict is not_affected with justification requires_configuration.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.5), Snyk (< 1.5.5).",
      "vulnerability": {
        "name": "CVE-2016-2173"
      },
      "impact_statement": "CVE-2016-2173 affects Spring AMQP before version 1.5.5 due to unsafe Java deserialization in DefaultDeserializer. The target repository is Spring AMQP version 2.4.5, which contains the upstream fix introduced in commit 462dcb6f1 (AMQP-590). The fix adds an allowlist-based deserialization filter infrastructure via AllowedListDeserializingMessageConverter and checkAllowedList() mechanism. However, by default the allowlist is empty (permitting all classes), requiring explicit configuration via setAllowedListPatterns() for protection. This disable-by-default strategy was the vendor's intentional fix approach. Since the fix was authored by upstream Spring AMQP maintainers (not TuxCare) and shipped in the upstream 2.4.5 release, the verdict is not_affected with justification requires_configuration.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.5), Snyk (< 1.5.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T10:55:31.258093+00:00",
      "status_notes": "Vulnerability CVE-2017-8045 does not affect version 2.4.5-tuxcare.1 of org.springframework.amqp:spring-amqp. Spring AMQP 2.4.5 is NOT affected by CVE-2017-8045. The vulnerability involved unsafe deserialization in Message.toString() that could lead to RCE. The target version contains an upstream fix (commit ed824637c by Gary Russell, September 2021) that completely removes deserialization from Message.toString(), replacing it with a safe string \"[serialized object]\". This fix was already present in Spring AMQP 2.4.5 when it was released in May 2022, before TuxCare onboarded it in October 2026. The fix is upstream-authored (vmware.com domain), not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.7; >= 1.6.0, < 1.6.11; >= 1.7.0, < 1.7.4), cve.org (< 1.7.4; = 1.6.11; = 1.5.7), Snyk (>= 1.5.6.RELEASE, < 1.5.7.RELEASE; >= 1.6.10.RELEASE, < 1.6.11.RELEASE; >= 1.7.3.RELEASE, < 1.7.4.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-8045"
      },
      "impact_statement": "Spring AMQP 2.4.5 is NOT affected by CVE-2017-8045. The vulnerability involved unsafe deserialization in Message.toString() that could lead to RCE. The target version contains an upstream fix (commit ed824637c by Gary Russell, September 2021) that completely removes deserialization from Message.toString(), replacing it with a safe string \"[serialized object]\". This fix was already present in Spring AMQP 2.4.5 when it was released in May 2022, before TuxCare onboarded it in October 2026. The fix is upstream-authored (vmware.com domain), not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.7; >= 1.6.0, < 1.6.11; >= 1.7.0, < 1.7.4), cve.org (< 1.7.4; = 1.6.11; = 1.5.7), Snyk (>= 1.5.6.RELEASE, < 1.5.7.RELEASE; >= 1.6.10.RELEASE, < 1.6.11.RELEASE; >= 1.7.3.RELEASE, < 1.7.4.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T10:55:31.258093+00:00",
      "status_notes": "Vulnerability CVE-2018-11087 does not affect version 2.4.5-tuxcare.1 of org.springframework.amqp:spring-amqp. not_affected \u2014 CVE-2018-11087 affects Spring AMQP versions 1.x < 1.7.10 and 2.x < 2.0.6 due to missing hostname verification during TLS connections, enabling man-in-the-middle attacks. The target (Spring AMQP 2.4.5) is NOT AFFECTED because the upstream fix (commit 444b74e95 by Gary Russell from Pivotal) was already included in the 2.4.5 release. The code shows `enableHostnameVerification = true` by default wi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11087"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-11087 affects Spring AMQP versions 1.x < 1.7.10 and 2.x < 2.0.6 due to missing hostname verification during TLS connections, enabling man-in-the-middle attacks. The target (Spring AMQP 2.4.5) is NOT AFFECTED because the upstream fix (commit 444b74e95 by Gary Russell from Pivotal) was already included in the 2.4.5 release. The code shows `enableHostnameVerification = true` by default wi..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T10:55:31.258093+00:00",
      "status_notes": "Vulnerability CVE-2021-22095 does not affect version 2.4.5-tuxcare.1 of org.springframework.amqp:spring-amqp. not_affected \u2014 Spring AMQP 2.4.5 is not affected by CVE-2021-22095. The vulnerability (unbounded String allocation in Message.toString() causing OOM errors) was fixed upstream by VMware/Spring in commit 4f3a1539d before version 2.4.5 was released. The fix adds a configurable maxBodyLength limit (default 50 bytes) and checks body.length before String conversion. This upstream fix was already present when TuxCa...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22095"
      },
      "impact_statement": "not_affected \u2014 Spring AMQP 2.4.5 is not affected by CVE-2021-22095. The vulnerability (unbounded String allocation in Message.toString() causing OOM errors) was fixed upstream by VMware/Spring in commit 4f3a1539d before version 2.4.5 was released. The fix adds a configurable maxBodyLength limit (default 50 bytes) and checks body.length before String conversion. This upstream fix was already present when TuxCa..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T10:55:31.258093+00:00",
      "status_notes": "Vulnerability CVE-2021-22097 does not affect version 2.4.5-tuxcare.1 of org.springframework.amqp:spring-amqp. not_affected \u2014 Spring AMQP 2.4.5 is NOT vulnerable to CVE-2021-22097. The vulnerable deserialization code in Message.toString() has been removed and replaced with a safe literal string \"[serialized object]\". This fix was committed by upstream Spring AMQP author Gary Russell (VMware) in commit ed824637c on September 27, 2021, and was already included in the upstream 2.4.5 release before TuxCare onboarded it. V...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22097"
      },
      "impact_statement": "not_affected \u2014 Spring AMQP 2.4.5 is NOT vulnerable to CVE-2021-22097. The vulnerable deserialization code in Message.toString() has been removed and replaced with a safe literal string \"[serialized object]\". This fix was committed by upstream Spring AMQP author Gary Russell (VMware) in commit ed824637c on September 27, 2021, and was already included in the upstream 2.4.5 release before TuxCare onboarded it. V..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-08T22:15:16.108718+00:00",
      "status_notes": "Vulnerability CVE-2026-41701 affects version 2.4.5-tuxcare.1 of org.springframework.amqp:spring-amqp, and is fixed in 2.4.5-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-41701"
      },
      "action_statement": "Vulnerability CVE-2026-41701 affects version 2.4.5-tuxcare.1 of org.springframework.amqp:spring-amqp, and is fixed in 2.4.5-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-08T22:15:16.108718+00:00",
      "status_notes": "Vulnerability CVE-2026-41714 affects version 2.4.5-tuxcare.1 of org.springframework.amqp:spring-amqp, and is fixed in 2.4.5-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-41714"
      },
      "action_statement": "Vulnerability CVE-2026-41714 affects version 2.4.5-tuxcare.1 of org.springframework.amqp:spring-amqp, and is fixed in 2.4.5-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-08T22:15:16.108718+00:00",
      "status_notes": "Vulnerability CVE-2026-47860 affects version 2.4.5-tuxcare.1 of org.springframework.amqp:spring-amqp, and is fixed in 2.4.5-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-47860"
      },
      "action_statement": "Vulnerability CVE-2026-47860 affects version 2.4.5-tuxcare.1 of org.springframework.amqp:spring-amqp, and is fixed in 2.4.5-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-08T22:15:16.108718+00:00",
      "status_notes": "Vulnerability CVE-2026-59275 affects version 2.4.5-tuxcare.1 of org.springframework.amqp:spring-amqp, and is fixed in 2.4.5-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-59275"
      },
      "action_statement": "Vulnerability CVE-2026-59275 affects version 2.4.5-tuxcare.1 of org.springframework.amqp:spring-amqp, and is fixed in 2.4.5-tuxcare.2."
    }
  ]
}