{
  "@id": "urn:uuid:8a06619b-b534-46ed-9b4f-5e517a587991",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 5,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-05T12:46:45.968557+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T12:09:00.012843+00:00",
      "status_notes": "Vulnerability CVE-2016-2173 does not affect version 2.4.8-tuxcare.1 of org.springframework.amqp:spring-amqp. Target version 2.4.8 is NOT affected by CVE-2016-2173. The vulnerability (unsafe Java deserialization allowing RCE) was fixed by upstream Spring AMQP maintainers in version 1.5.5. The target contains the defense mechanism: AllowedListDeserializingMessageConverter (renamed from WhiteListDeserializingMessageConverter) with checkAllowedList() validation during ObjectInputStream.resolveClass(). The fix commit ee52539c1 was authored by upstream Spring maintainers (grussell@vmware.com, abilan@pivotal.io) and shipped in the upstream 2.4.8 release before TuxCare onboarded it. This is an upstream fix, not a TuxCare backport.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-2173"
      },
      "impact_statement": "Target version 2.4.8 is NOT affected by CVE-2016-2173. The vulnerability (unsafe Java deserialization allowing RCE) was fixed by upstream Spring AMQP maintainers in version 1.5.5. The target contains the defense mechanism: AllowedListDeserializingMessageConverter (renamed from WhiteListDeserializingMessageConverter) with checkAllowedList() validation during ObjectInputStream.resolveClass(). The fix commit ee52539c1 was authored by upstream Spring maintainers (grussell@vmware.com, abilan@pivotal.io) and shipped in the upstream 2.4.8 release before TuxCare onboarded it. This is an upstream fix, not a TuxCare backport."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T12:46:45.968557+00:00",
      "status_notes": "Vulnerability CVE-2017-8045 does not affect version 2.4.8-tuxcare.1 of org.springframework.amqp:spring-amqp. CVE-2017-8045 affects Spring AMQP before 1.5.7, 1.6.0\u20131.6.10 and 1.7.0\u20131.7.3 (Spring advisory, NVD); it is fixed upstream in 1.5.7, 1.6.11 and 1.7.4. Version 2.4.8 is later than every fixed release and already contains the upstream fix, so the unsafe deserialization in Message.toString() is not present.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-8045"
      },
      "impact_statement": "CVE-2017-8045 affects Spring AMQP before 1.5.7, 1.6.0\u20131.6.10 and 1.7.0\u20131.7.3 (Spring advisory, NVD); it is fixed upstream in 1.5.7, 1.6.11 and 1.7.4. Version 2.4.8 is later than every fixed release and already contains the upstream fix, so the unsafe deserialization in Message.toString() is not present."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T08:46:00.060809+00:00",
      "status_notes": "Vulnerability CVE-2018-11087 does not affect version 2.4.8-tuxcare.1 of org.springframework.amqp:spring-amqp. not_affected \u2014 Target version 2.4.8 is not affected by CVE-2018-11087. The vulnerability concerns missing hostname verification in TLS connections, which could allow man-in-the-middle attacks. The fix (enabling hostname verification by default) was implemented by upstream Spring AMQP developers and shipped in version 2.1.0.M3 (August 2018). Version 2.4.8 already contains this fix as part of the upstream relea...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11087"
      },
      "impact_statement": "not_affected \u2014 Target version 2.4.8 is not affected by CVE-2018-11087. The vulnerability concerns missing hostname verification in TLS connections, which could allow man-in-the-middle attacks. The fix (enabling hostname verification by default) was implemented by upstream Spring AMQP developers and shipped in version 2.1.0.M3 (August 2018). Version 2.4.8 already contains this fix as part of the upstream relea..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T08:45:04.910133+00:00",
      "status_notes": "Vulnerability CVE-2021-22095 does not affect version 2.4.8-tuxcare.1 of org.springframework.amqp:spring-amqp. not_affected \u2014 Spring AMQP version 2.4.8 is not affected by CVE-2021-22095. The vulnerability (OOM error from unconditional String conversion in Message.toString()) was fixed in upstream version 2.2.20. The target version 2.4.8 includes this fix as part of the upstream release onboarded by TuxCare. The fix adds a configurable size limit (default 50 bytes) preventing large message bodies from being converted t...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22095"
      },
      "impact_statement": "not_affected \u2014 Spring AMQP version 2.4.8 is not affected by CVE-2021-22095. The vulnerability (OOM error from unconditional String conversion in Message.toString()) was fixed in upstream version 2.2.20. The target version 2.4.8 includes this fix as part of the upstream release onboarded by TuxCare. The fix adds a configurable size limit (default 50 bytes) preventing large message bodies from being converted t..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T08:45:04.910133+00:00",
      "status_notes": "Vulnerability CVE-2021-22097 does not affect version 2.4.8-tuxcare.1 of org.springframework.amqp:spring-amqp. not_affected \u2014 Spring AMQP 2.4.8 is not affected by CVE-2021-22097. The vulnerability (uncontrolled deserialization in Message.toString() for serialized objects) was fixed upstream by VMware before the 2.4.8 release. The fix commit ed824637cc922356b44409827722c4628340b7c8 by Gary Russell is present in the onboarded version, replacing the dangerous SerializationUtils.deserialize() call with a safe placeholder ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22097"
      },
      "impact_statement": "not_affected \u2014 Spring AMQP 2.4.8 is not affected by CVE-2021-22097. The vulnerability (uncontrolled deserialization in Message.toString() for serialized objects) was fixed upstream by VMware before the 2.4.8 release. The fix commit ed824637cc922356b44409827722c4628340b7c8 by Gary Russell is present in the onboarded version, replacing the dangerous SerializationUtils.deserialize() call with a safe placeholder ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T06:01:33.175257+00:00",
      "status_notes": "Vulnerability CVE-2026-41701 affects version 2.4.8-tuxcare.1 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-41701"
      },
      "action_statement": "Vulnerability CVE-2026-41701 affects version 2.4.8-tuxcare.1 of org.springframework.amqp:spring-amqp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T06:01:33.175257+00:00",
      "status_notes": "Vulnerability CVE-2026-41714 affects version 2.4.8-tuxcare.1 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-41714"
      },
      "action_statement": "Vulnerability CVE-2026-41714 affects version 2.4.8-tuxcare.1 of org.springframework.amqp:spring-amqp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T06:01:33.175257+00:00",
      "status_notes": "Vulnerability CVE-2026-47860 affects version 2.4.8-tuxcare.1 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-47860"
      },
      "action_statement": "Vulnerability CVE-2026-47860 affects version 2.4.8-tuxcare.1 of org.springframework.amqp:spring-amqp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T06:01:33.175257+00:00",
      "status_notes": "Vulnerability CVE-2026-59275 affects version 2.4.8-tuxcare.1 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-59275"
      },
      "action_statement": "Vulnerability CVE-2026-59275 affects version 2.4.8-tuxcare.1 of org.springframework.amqp:spring-amqp."
    }
  ]
}