{
  "@id": "urn:uuid:bfa74926-4f3d-4949-811c-74a68016c684",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-08T16:57:45.969336+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-08T16:57:18.276689+00:00",
      "status_notes": "Vulnerability CVE-2016-2173 does not affect version 3.1.5-tuxcare.3 of org.springframework.amqp:spring-amqp. CVE-2016-2173 affects Spring AMQP before version 1.5.5 due to unsafe Java deserialization in org.springframework.core.serializer.DefaultDeserializer, allowing remote code execution. The target version 3.1.5-tuxcare.1 is NOT affected because the upstream fix was already present in version 3.1.5 when TuxCare onboarded it. The fix (commit 462dcb6f1, \"AMQP-590: Java Deserialization White List\", March 15, 2016) introduced AllowedListDeserializingMessageConverter (originally WhiteListDeserializingMessageConverter) which blocks arbitrary class deserialization by enforcing an allowlist pattern check via checkAllowedList() method during ObjectInputStream.resolveClass(). Both SerializerMessageConverter and SimpleMessageConverter extend this protected base class and inherit the defense. The fix was authored by upstream maintainer Gary Russell <grussell@pivotal.io> and shipped in the upstream release before TuxCare's involvement.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.5), Snyk (< 1.5.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-2173"
      },
      "impact_statement": "CVE-2016-2173 affects Spring AMQP before version 1.5.5 due to unsafe Java deserialization in org.springframework.core.serializer.DefaultDeserializer, allowing remote code execution. The target version 3.1.5-tuxcare.1 is NOT affected because the upstream fix was already present in version 3.1.5 when TuxCare onboarded it. The fix (commit 462dcb6f1, \"AMQP-590: Java Deserialization White List\", March 15, 2016) introduced AllowedListDeserializingMessageConverter (originally WhiteListDeserializingMessageConverter) which blocks arbitrary class deserialization by enforcing an allowlist pattern check via checkAllowedList() method during ObjectInputStream.resolveClass(). Both SerializerMessageConverter and SimpleMessageConverter extend this protected base class and inherit the defense. The fix was authored by upstream maintainer Gary Russell <grussell@pivotal.io> and shipped in the upstream release before TuxCare's involvement.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.5), Snyk (< 1.5.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-08T16:57:18.276689+00:00",
      "status_notes": "Vulnerability CVE-2017-8045 does not affect version 3.1.5-tuxcare.3 of org.springframework.amqp:spring-amqp. CVE-2017-8045 describes unsafe Java deserialization in Spring AMQP's Message.toString() method that could lead to remote code execution. The target version 3.1.5 is NOT AFFECTED because the vulnerability was fixed by upstream Spring developers and included in the upstream release before TuxCare onboarded this version. The original fix (commit 36e55998f, September 2017, AMQP-766) addressed CVE-2017-8045 by adding whitelist-based safe deserialization. This was later strengthened (commit ed824637cc, September 2021) to eliminate deserialization entirely in toString(), returning the safe placeholder string \"[serialized object]\" instead of attempting to deserialize the message body. Both fixes were authored by Gary Russell from Pivotal/VMware (not TuxCare/CloudLinux) and were present in the upstream 3.1.5 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.7; >= 1.6.0, < 1.6.11; >= 1.7.0, < 1.7.4), cve.org (< 1.7.4; = 1.6.11; = 1.5.7), Snyk (>= 1.5.6.RELEASE, < 1.5.7.RELEASE; >= 1.6.10.RELEASE, < 1.6.11.RELEASE; >= 1.7.3.RELEASE, < 1.7.4.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-8045"
      },
      "impact_statement": "CVE-2017-8045 describes unsafe Java deserialization in Spring AMQP's Message.toString() method that could lead to remote code execution. The target version 3.1.5 is NOT AFFECTED because the vulnerability was fixed by upstream Spring developers and included in the upstream release before TuxCare onboarded this version. The original fix (commit 36e55998f, September 2017, AMQP-766) addressed CVE-2017-8045 by adding whitelist-based safe deserialization. This was later strengthened (commit ed824637cc, September 2021) to eliminate deserialization entirely in toString(), returning the safe placeholder string \"[serialized object]\" instead of attempting to deserialize the message body. Both fixes were authored by Gary Russell from Pivotal/VMware (not TuxCare/CloudLinux) and were present in the upstream 3.1.5 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.7; >= 1.6.0, < 1.6.11; >= 1.7.0, < 1.7.4), cve.org (< 1.7.4; = 1.6.11; = 1.5.7), Snyk (>= 1.5.6.RELEASE, < 1.5.7.RELEASE; >= 1.6.10.RELEASE, < 1.6.11.RELEASE; >= 1.7.3.RELEASE, < 1.7.4.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-08T16:57:18.276689+00:00",
      "status_notes": "Vulnerability CVE-2018-11087 does not affect version 3.1.5-tuxcare.3 of org.springframework.amqp:spring-amqp. not_affected \u2014 The target repository (Spring AMQP 3.1.5) is NOT AFFECTED by CVE-2018-11087. The vulnerability (lack of SSL/TLS hostname verification enabling MITM attacks) was fixed by upstream commit 444b74e95 in August 2018, which enabled hostname verification by default in RabbitConnectionFactoryBean. This fix was already present in Spring AMQP 3.1.5 when TuxCare onboarded it in October 2026. The vulnerabl...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11087"
      },
      "impact_statement": "not_affected \u2014 The target repository (Spring AMQP 3.1.5) is NOT AFFECTED by CVE-2018-11087. The vulnerability (lack of SSL/TLS hostname verification enabling MITM attacks) was fixed by upstream commit 444b74e95 in August 2018, which enabled hostname verification by default in RabbitConnectionFactoryBean. This fix was already present in Spring AMQP 3.1.5 when TuxCare onboarded it in October 2026. The vulnerabl..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-08T16:57:18.276689+00:00",
      "status_notes": "Vulnerability CVE-2021-22095 does not affect version 3.1.5-tuxcare.3 of org.springframework.amqp:spring-amqp. not_affected \u2014 CVE-2021-22095 affects Spring AMQP 2.2.0-2.2.19 and 2.3.0-2.3.11. Target version 3.1.5 is not affected because the upstream fix (commit 4f3a1539da by Gary Russell) was already present in the upstream release when TuxCare onboarded it. The fix adds a configurable size limit (maxBodyLength, default 50 bytes) to Message.toString(), preventing OOM errors from large message bodies. The vulnerable pa...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22095"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22095 affects Spring AMQP 2.2.0-2.2.19 and 2.3.0-2.3.11. Target version 3.1.5 is not affected because the upstream fix (commit 4f3a1539da by Gary Russell) was already present in the upstream release when TuxCare onboarded it. The fix adds a configurable size limit (maxBodyLength, default 50 bytes) to Message.toString(), preventing OOM errors from large message bodies. The vulnerable pa..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-08T16:57:18.276689+00:00",
      "status_notes": "Vulnerability CVE-2021-22097 does not affect version 3.1.5-tuxcare.3 of org.springframework.amqp:spring-amqp. not_affected \u2014 CVE-2021-22097 is NOT present in Spring AMQP 3.1.5. The vulnerability involved unsafe deserialization in the Message.toString() method for messages with content type application/x-java-serialized-object, allowing CPU exhaustion via malicious objects. The fix was already included in the upstream 3.1.5 release that TuxCare onboarded. The current code returns a safe placeholder string \"[serialized...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22097"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22097 is NOT present in Spring AMQP 3.1.5. The vulnerability involved unsafe deserialization in the Message.toString() method for messages with content type application/x-java-serialized-object, allowing CPU exhaustion via malicious objects. The fix was already included in the upstream 3.1.5 release that TuxCare onboarded. The current code returns a safe placeholder string \"[serialized..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-08T16:57:45.969336+00:00",
      "status_notes": "Vulnerability CVE-2026-41701 is fixed in version 3.1.5-tuxcare.3 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-41701"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-08T16:57:45.969336+00:00",
      "status_notes": "Vulnerability CVE-2026-41714 is fixed in version 3.1.5-tuxcare.3 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-41714"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-08T16:57:45.969336+00:00",
      "status_notes": "Vulnerability CVE-2026-47860 is fixed in version 3.1.5-tuxcare.3 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-47860"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.1.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-08T16:57:45.969336+00:00",
      "status_notes": "Vulnerability CVE-2026-59275 is fixed in version 3.1.5-tuxcare.3 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-59275"
      }
    }
  ]
}