{
  "@id": "urn:uuid:0a47e94a-2faf-45f5-8e10-9ce4678bc1dc",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 6,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T11:23:28.962205+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T12:11:55.615529+00:00",
      "status_notes": "Vulnerability CVE-2016-2173 does not affect version 2.4.9-tuxcare.1 of org.springframework.amqp:spring-amqp. CVE-2016-2173 affects Spring AMQP 1.0.0-1.5.4 only (fixed in 1.5.5, commit 462dcb6f). Spring AMQP 2.4.9 already ships the deserialization allow-list (AllowedListDeserializingMessageConverter) introduced by that fix, so the vulnerable unrestricted deserialization path is not present.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-2173"
      },
      "impact_statement": "CVE-2016-2173 affects Spring AMQP 1.0.0-1.5.4 only (fixed in 1.5.5, commit 462dcb6f). Spring AMQP 2.4.9 already ships the deserialization allow-list (AllowedListDeserializingMessageConverter) introduced by that fix, so the vulnerable unrestricted deserialization path is not present."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T12:46:45.968557+00:00",
      "status_notes": "Vulnerability CVE-2017-8045 does not affect version 2.4.9-tuxcare.1 of org.springframework.amqp:spring-amqp. CVE-2017-8045 affects Spring AMQP before 1.5.7, 1.6.0\u20131.6.10 and 1.7.0\u20131.7.3 (Spring advisory, NVD); it is fixed upstream in 1.5.7, 1.6.11 and 1.7.4. Version 2.4.9 is later than every fixed release and already contains the upstream fix, so the unsafe deserialization in Message.toString() is not present.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-8045"
      },
      "impact_statement": "CVE-2017-8045 affects Spring AMQP before 1.5.7, 1.6.0\u20131.6.10 and 1.7.0\u20131.7.3 (Spring advisory, NVD); it is fixed upstream in 1.5.7, 1.6.11 and 1.7.4. Version 2.4.9 is later than every fixed release and already contains the upstream fix, so the unsafe deserialization in Message.toString() is not present."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T11:23:28.962205+00:00",
      "status_notes": "Vulnerability CVE-2018-11087 does not affect version 2.4.9-tuxcare.1 of org.springframework.amqp:spring-amqp. not_affected \u2014 Target (spring-amqp 2.4.9) already contains the upstream hostname-verification fix for CVE-2018-11087 (AMQP-830). RabbitConnectionFactoryBean defaults enableHostnameVerification=true and calls connectionFactory.enableHostnameVerification() on both SSL setup paths. The fix commit 444b74e95 is by an upstream author (grussell@pivotal.io) and is already in the upstream release that TuxCare onboarde...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11087"
      },
      "impact_statement": "not_affected \u2014 Target (spring-amqp 2.4.9) already contains the upstream hostname-verification fix for CVE-2018-11087 (AMQP-830). RabbitConnectionFactoryBean defaults enableHostnameVerification=true and calls connectionFactory.enableHostnameVerification() on both SSL setup paths. The fix commit 444b74e95 is by an upstream author (grussell@pivotal.io) and is already in the upstream release that TuxCare onboarde..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T10:41:28.069303+00:00",
      "status_notes": "Vulnerability CVE-2021-22095 does not affect version 2.4.9-tuxcare.1 of org.springframework.amqp:spring-amqp. not_affected \u2014 Spring AMQP 2.4.9 already contains the upstream fix for CVE-2021-22095. Message.toString() no longer converts an unbounded body to a String. It converts only text-like bodies of at most maxBodyLength bytes (default 50), and otherwise returns a short '[B@..(byte[N])' placeholder. The fix, upstream commit 4f3a1539d ('Message toString() Improvement'), predates the first TuxCare commit.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22095"
      },
      "impact_statement": "not_affected \u2014 Spring AMQP 2.4.9 already contains the upstream fix for CVE-2021-22095. Message.toString() no longer converts an unbounded body to a String. It converts only text-like bodies of at most maxBodyLength bytes (default 50), and otherwise returns a short '[B@..(byte[N])' placeholder. The fix, upstream commit 4f3a1539d ('Message toString() Improvement'), predates the first TuxCare commit."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T10:40:54.701960+00:00",
      "status_notes": "Vulnerability CVE-2021-22097 does not affect version 2.4.9-tuxcare.1 of org.springframework.amqp:spring-amqp. not_affected \u2014 Spring AMQP 2.4.9 is not affected by CVE-2021-22097. Message.toString() no longer deserializes the body. For the serialized-object content type it renders the literal \"[serialized object]\". Upstream commit 4f3a1539d (\"Message toString() Improvement\") shipped in the upstream release that TuxCare onboarded.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22097"
      },
      "impact_statement": "not_affected \u2014 Spring AMQP 2.4.9 is not affected by CVE-2021-22097. Message.toString() no longer deserializes the body. For the serialized-object content type it renders the literal \"[serialized object]\". Upstream commit 4f3a1539d (\"Message toString() Improvement\") shipped in the upstream release that TuxCare onboarded."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T07:30:29.787772+00:00",
      "status_notes": "Vulnerability CVE-2026-41701 affects version 2.4.9-tuxcare.1 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-41701"
      },
      "action_statement": "Vulnerability CVE-2026-41701 affects version 2.4.9-tuxcare.1 of org.springframework.amqp:spring-amqp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T07:30:29.787772+00:00",
      "status_notes": "Vulnerability CVE-2026-41714 affects version 2.4.9-tuxcare.1 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-41714"
      },
      "action_statement": "Vulnerability CVE-2026-41714 affects version 2.4.9-tuxcare.1 of org.springframework.amqp:spring-amqp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T07:30:29.787772+00:00",
      "status_notes": "Vulnerability CVE-2026-47860 affects version 2.4.9-tuxcare.1 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-47860"
      },
      "action_statement": "Vulnerability CVE-2026-47860 affects version 2.4.9-tuxcare.1 of org.springframework.amqp:spring-amqp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@2.4.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T07:30:29.787772+00:00",
      "status_notes": "Vulnerability CVE-2026-59275 affects version 2.4.9-tuxcare.1 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-59275"
      },
      "action_statement": "Vulnerability CVE-2026-59275 affects version 2.4.9-tuxcare.1 of org.springframework.amqp:spring-amqp."
    }
  ]
}