{
  "@id": "urn:uuid:e195c124-0862-446b-86ec-68f8810454f2",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 10,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:05:53.304095+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.2.12-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.2.12-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:04:11.456857+00:00",
      "status_notes": "Vulnerability CVE-2016-2173 does not affect version 3.2.12-tuxcare.3 of org.springframework.amqp:spring-amqp. CVE-2016-2173 is a Java deserialization vulnerability affecting Spring AMQP versions before 1.5.5. The target version 3.2.12-tuxcare.3 contains the upstream fix introduced in version 1.5.5 (March 2016) via commit 462dcb6f1. The fix adds allowed-list validation for deserialized classes through AllowedListDeserializingMessageConverter, which intercepts class resolution during ObjectInputStream deserialization and validates against configured patterns. By default, the allowed list is empty, meaning only primitives, Numbers, and Strings can be deserialized\u2014all other classes trigger a SecurityException. This secure-by-default configuration completely mitigates the vulnerability. The fix was authored by upstream Spring developers (Pivotal/VMware) and was present in the upstream 3.2.12 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.5), Snyk (< 1.5.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-2173"
      },
      "impact_statement": "CVE-2016-2173 is a Java deserialization vulnerability affecting Spring AMQP versions before 1.5.5. The target version 3.2.12-tuxcare.3 contains the upstream fix introduced in version 1.5.5 (March 2016) via commit 462dcb6f1. The fix adds allowed-list validation for deserialized classes through AllowedListDeserializingMessageConverter, which intercepts class resolution during ObjectInputStream deserialization and validates against configured patterns. By default, the allowed list is empty, meaning only primitives, Numbers, and Strings can be deserialized\u2014all other classes trigger a SecurityException. This secure-by-default configuration completely mitigates the vulnerability. The fix was authored by upstream Spring developers (Pivotal/VMware) and was present in the upstream 3.2.12 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.5), Snyk (< 1.5.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.2.12-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.2.12-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2017-8045 does not affect version 3.2.12-tuxcare.3 of org.springframework.amqp:spring-amqp. CVE-2017-8045 describes unsafe Java deserialization in Spring AMQP's Message.toString() method that could lead to remote code execution. The target version (3.2.12-tuxcare.3) is NOT vulnerable. The upstream fix (commit ed824637c) was already present in Spring AMQP 3.2.12 when TuxCare onboarded it. The fix replaces deserialization with a safe placeholder string \"[serialized object]\" when content type indicates a serialized object, completely eliminating the attack surface.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.7; >= 1.6.0, < 1.6.11; >= 1.7.0, < 1.7.4), cve.org (< 1.7.4; = 1.6.11; = 1.5.7), Snyk (>= 1.5.6.RELEASE, < 1.5.7.RELEASE; >= 1.6.10.RELEASE, < 1.6.11.RELEASE; >= 1.7.3.RELEASE, < 1.7.4.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-8045"
      },
      "impact_statement": "CVE-2017-8045 describes unsafe Java deserialization in Spring AMQP's Message.toString() method that could lead to remote code execution. The target version (3.2.12-tuxcare.3) is NOT vulnerable. The upstream fix (commit ed824637c) was already present in Spring AMQP 3.2.12 when TuxCare onboarded it. The fix replaces deserialization with a safe placeholder string \"[serialized object]\" when content type indicates a serialized object, completely eliminating the attack surface.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.7; >= 1.6.0, < 1.6.11; >= 1.7.0, < 1.7.4), cve.org (< 1.7.4; = 1.6.11; = 1.5.7), Snyk (>= 1.5.6.RELEASE, < 1.5.7.RELEASE; >= 1.6.10.RELEASE, < 1.6.11.RELEASE; >= 1.7.3.RELEASE, < 1.7.4.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.2.12-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.2.12-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T01:27:53.972569+00:00",
      "status_notes": "Vulnerability CVE-2018-11087 does not affect version 3.2.12-tuxcare.3 of org.springframework.amqp:spring-amqp. not_affected \u2014 Spring AMQP 3.2.12 is NOT affected by CVE-2018-11087. The vulnerability (lack of hostname verification in TLS connections enabling man-in-the-middle attacks) was fixed in upstream version 2.0.6 via commit 444b74e95 (August 2018) which enabled hostname verification by default. This fix was already present in the upstream release 3.2.12 when TuxCare onboarded it. Target version 3.2.12 is signific...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11087"
      },
      "impact_statement": "not_affected \u2014 Spring AMQP 3.2.12 is NOT affected by CVE-2018-11087. The vulnerability (lack of hostname verification in TLS connections enabling man-in-the-middle attacks) was fixed in upstream version 2.0.6 via commit 444b74e95 (August 2018) which enabled hostname verification by default. This fix was already present in the upstream release 3.2.12 when TuxCare onboarded it. Target version 3.2.12 is signific..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.2.12-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.2.12-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T05:02:00.518069+00:00",
      "status_notes": "Vulnerability CVE-2021-22095 does not affect version 3.2.12-tuxcare.3 of org.springframework.amqp:spring-amqp. not_affected \u2014 The target Spring AMQP 3.2.12 is NOT vulnerable to CVE-2021-22095. The vulnerability pattern (unbounded byte-array-to-String conversion in Message.toString() causing OOM) is not present. The fix was introduced by upstream vendor commit 4f3a1539d in v2.4.0 (authored by Gary Russell <grussell@vmware.com>), which predates the 3.2.12 release. The target's Message.java contains the defense at line 1...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22095"
      },
      "impact_statement": "not_affected \u2014 The target Spring AMQP 3.2.12 is NOT vulnerable to CVE-2021-22095. The vulnerability pattern (unbounded byte-array-to-String conversion in Message.toString() causing OOM) is not present. The fix was introduced by upstream vendor commit 4f3a1539d in v2.4.0 (authored by Gary Russell <grussell@vmware.com>), which predates the 3.2.12 release. The target's Message.java contains the defense at line 1..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.2.12-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.2.12-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T05:04:00.209412+00:00",
      "status_notes": "Vulnerability CVE-2021-22097 does not affect version 3.2.12-tuxcare.3 of org.springframework.amqp:spring-amqp. not_affected \u2014 CVE-2021-22097 is NOT present in Spring AMQP 3.2.12. The vulnerability involves unsafe Java deserialization in Message.toString() when processing messages with content type 'application/x-java-serialized-object', allowing malicious Dictionary objects to cause CPU exhaustion. The upstream Spring AMQP team fixed this vulnerability in commit ed824637c by completely removing deserialization from th...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22097"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-22097 is NOT present in Spring AMQP 3.2.12. The vulnerability involves unsafe Java deserialization in Message.toString() when processing messages with content type 'application/x-java-serialized-object', allowing malicious Dictionary objects to cause CPU exhaustion. The upstream Spring AMQP team fixed this vulnerability in commit ed824637c by completely removing deserialization from th..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.2.12-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.2.12-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-23T11:01:49.503620+00:00",
      "status_notes": "Vulnerability CVE-2026-41701 does not affect version 3.2.12-tuxcare.3 of org.springframework.amqp:spring-amqp. Spring Amqp 3.2.12 is not vulnerable as it is higher than upstream fix version - 3.2.11",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-41701"
      },
      "impact_statement": "Spring Amqp 3.2.12 is not vulnerable as it is higher than upstream fix version - 3.2.11"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.2.12-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.2.12-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-23T11:01:49.503620+00:00",
      "status_notes": "Vulnerability CVE-2026-41714 does not affect version 3.2.12-tuxcare.3 of org.springframework.amqp:spring-amqp. Spring Amqp 3.2.12 is not vulnerable as it is higher than upstream fix version - 3.2.11",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-41714"
      },
      "impact_statement": "Spring Amqp 3.2.12 is not vulnerable as it is higher than upstream fix version - 3.2.11"
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.2.12-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.2.12-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-23T09:01:33.961631+00:00",
      "status_notes": "Vulnerability CVE-2026-47860 is fixed in version 3.2.12-tuxcare.3 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-47860"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.2.12-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.2.12-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-23T09:01:33.961631+00:00",
      "status_notes": "Vulnerability CVE-2026-59275 is fixed in version 3.2.12-tuxcare.3 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-59275"
      }
    }
  ]
}