{
  "@id": "urn:uuid:66e8a3a8-8b3b-46c3-adf9-edf707d1186a",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 8,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:04:11.456857+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.11-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.11-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:02:00.202619+00:00",
      "status_notes": "Vulnerability CVE-2016-2173 does not affect version 3.1.11-tuxcare.1 of org.springframework.amqp:spring-amqp. CVE-2016-2173 affects Spring AMQP versions before 1.5.5 due to unsafe Java deserialization in DefaultDeserializer. The vulnerability allowed remote attackers to execute arbitrary code by sending malicious serialized objects. The target version 3.1.11-tuxcare.1 is NOT vulnerable because the fix was introduced in upstream version 1.5.5 (March 2016) and was already present in the upstream release that TuxCare onboarded. The fix added AllowedListDeserializingMessageConverter (originally WhiteListDeserializingMessageConverter) with pattern-based class filtering that validates classes during deserialization via a custom resolveClass() implementation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.5), Snyk (< 1.5.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-2173"
      },
      "impact_statement": "CVE-2016-2173 affects Spring AMQP versions before 1.5.5 due to unsafe Java deserialization in DefaultDeserializer. The vulnerability allowed remote attackers to execute arbitrary code by sending malicious serialized objects. The target version 3.1.11-tuxcare.1 is NOT vulnerable because the fix was introduced in upstream version 1.5.5 (March 2016) and was already present in the upstream release that TuxCare onboarded. The fix added AllowedListDeserializingMessageConverter (originally WhiteListDeserializingMessageConverter) with pattern-based class filtering that validates classes during deserialization via a custom resolveClass() implementation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.5), Snyk (< 1.5.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.11-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.11-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:04:11.456857+00:00",
      "status_notes": "Vulnerability CVE-2017-8045 does not affect version 3.1.11-tuxcare.1 of org.springframework.amqp:spring-amqp. The target Spring AMQP version 3.1.11 is NOT vulnerable to CVE-2017-8045. The vulnerability involved unsafe deserialization in the Message.toString() method, which could lead to remote code execution when processing malicious AMQP messages. The vulnerable code pattern (SerializationUtils.deserialize called in toString()) was removed by upstream commit ed824637 in September 2021, which replaced unsafe deserialization with a safe string representation \"[serialized object]\". This fix was already present in upstream release 3.1.11 when TuxCare onboarded it, making the target not affected by this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.7; >= 1.6.0, < 1.6.11; >= 1.7.0, < 1.7.4), cve.org (< 1.7.4; = 1.6.11; = 1.5.7), Snyk (>= 1.5.6.RELEASE, < 1.5.7.RELEASE; >= 1.6.10.RELEASE, < 1.6.11.RELEASE; >= 1.7.3.RELEASE, < 1.7.4.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-8045"
      },
      "impact_statement": "The target Spring AMQP version 3.1.11 is NOT vulnerable to CVE-2017-8045. The vulnerability involved unsafe deserialization in the Message.toString() method, which could lead to remote code execution when processing malicious AMQP messages. The vulnerable code pattern (SerializationUtils.deserialize called in toString()) was removed by upstream commit ed824637 in September 2021, which replaced unsafe deserialization with a safe string representation \"[serialized object]\". This fix was already present in upstream release 3.1.11 when TuxCare onboarded it, making the target not affected by this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.7; >= 1.6.0, < 1.6.11; >= 1.7.0, < 1.7.4), cve.org (< 1.7.4; = 1.6.11; = 1.5.7), Snyk (>= 1.5.6.RELEASE, < 1.5.7.RELEASE; >= 1.6.10.RELEASE, < 1.6.11.RELEASE; >= 1.7.3.RELEASE, < 1.7.4.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.11-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.11-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T15:05:32.357543+00:00",
      "status_notes": "Vulnerability CVE-2018-11087 does not affect version 3.1.11-tuxcare.1 of org.springframework.amqp:spring-amqp. not_affected \u2014 Target repository Spring AMQP 3.1.11 contains the upstream vendor fix for CVE-2018-11087. Hostname verification is enabled by default (enableHostnameVerification = true), protecting against man-in-the-middle attacks. The fix was introduced in upstream commit 444b74e9 by Gary Russell (Pivotal) on 2018-08-28 and has been present since Spring AMQP 2.1.0. The vulnerable pattern (accepting TLS conne...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11087"
      },
      "impact_statement": "not_affected \u2014 Target repository Spring AMQP 3.1.11 contains the upstream vendor fix for CVE-2018-11087. Hostname verification is enabled by default (enableHostnameVerification = true), protecting against man-in-the-middle attacks. The fix was introduced in upstream commit 444b74e9 by Gary Russell (Pivotal) on 2018-08-28 and has been present since Spring AMQP 2.1.0. The vulnerable pattern (accepting TLS conne..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.11-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.11-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T05:01:45.788222+00:00",
      "status_notes": "Vulnerability CVE-2021-22095 does not affect version 3.1.11-tuxcare.1 of org.springframework.amqp:spring-amqp. not_affected \u2014 CVE-2021-22095 is NOT present in Spring AMQP 3.1.11-tuxcare.1. The vulnerability (unbounded string conversion in Message.toString() causing OOM with large messages) was fixed by upstream Spring/VMware in commit 4f3a1539d (Nov 2021). The fix adds a maxBodyLength check (default 50 bytes) that prevents converting large message bodies to strings. This upstream fix was already present in Spring AMQP...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22095"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22095 is NOT present in Spring AMQP 3.1.11-tuxcare.1. The vulnerability (unbounded string conversion in Message.toString() causing OOM with large messages) was fixed by upstream Spring/VMware in commit 4f3a1539d (Nov 2021). The fix adds a maxBodyLength check (default 50 bytes) that prevents converting large message bodies to strings. This upstream fix was already present in Spring AMQP..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.11-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.11-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T05:05:00.060068+00:00",
      "status_notes": "Vulnerability CVE-2021-22097 does not affect version 3.1.11-tuxcare.1 of org.springframework.amqp:spring-amqp. not_affected \u2014 The target Spring AMQP 3.1.11 is not affected by CVE-2021-22097. The vulnerability (unsafe deserialization in Message.toString() method) was fixed by upstream Spring AMQP in commit ed824637c (September 27, 2021) before version 3.1.11 was released. The fix was already present in the upstream release that TuxCare onboarded, confirmed by checking that the fix commit is an ancestor of the onboardin...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22097"
      },
      "impact_statement": "not_affected \u2014 The target Spring AMQP 3.1.11 is not affected by CVE-2021-22097. The vulnerability (unsafe deserialization in Message.toString() method) was fixed by upstream Spring AMQP in commit ed824637c (September 27, 2021) before version 3.1.11 was released. The fix was already present in the upstream release that TuxCare onboarded, confirmed by checking that the fix commit is an ancestor of the onboardin..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.11-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.11-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T15:07:00.215891+00:00",
      "status_notes": "Vulnerability CVE-2026-41701 is fixed in version 3.1.11-tuxcare.1 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-41701"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.11-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.11-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T15:07:00.215891+00:00",
      "status_notes": "Vulnerability CVE-2026-41714 is fixed in version 3.1.11-tuxcare.1 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-41714"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.11-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.11-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T15:07:00.215891+00:00",
      "status_notes": "Vulnerability CVE-2026-47860 is fixed in version 3.1.11-tuxcare.1 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-47860"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.11-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.11-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T15:07:00.215891+00:00",
      "status_notes": "Vulnerability CVE-2026-59275 is fixed in version 3.1.11-tuxcare.1 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-59275"
      }
    }
  ]
}