{
  "@id": "urn:uuid:4c136dd6-9c83-4732-be7b-71b2d903deca",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-29T15:30:49.741847+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-rabbit-junit@1.7.14.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-rabbit-junit@1.7.14.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T11:16:18.714666+00:00",
      "status_notes": "Vulnerability CVE-2018-11087 does not affect version 1.7.14.RELEASE-tuxcare.1 of org.springframework.amqp:spring-rabbit-junit. not_affected \u2014 CVE-2018-11087 is not present in Spring AMQP 1.7.14.RELEASE. The fix (commit aff4d0aef) was shipped in the upstream release and adds hostname verification capability via RabbitConnectionFactoryBean.setEnableHostnameVerification(). While disabled by default in 1.x (enabled by default in 2.x per patch 3), Rule 3 explicitly classifies \"disable-by-default\" as a valid fix strategy. The defense code ...",
      "vulnerability": {
        "name": "CVE-2018-11087"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-11087 is not present in Spring AMQP 1.7.14.RELEASE. The fix (commit aff4d0aef) was shipped in the upstream release and adds hostname verification capability via RabbitConnectionFactoryBean.setEnableHostnameVerification(). While disabled by default in 1.x (enabled by default in 2.x per patch 3), Rule 3 explicitly classifies \"disable-by-default\" as a valid fix strategy. The defense code ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-rabbit-junit@1.7.14.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-rabbit-junit@1.7.14.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T11:16:18.714666+00:00",
      "status_notes": "Vulnerability CVE-2026-59271 does not affect version 1.7.14.RELEASE-tuxcare.1 of org.springframework.amqp:spring-rabbit-junit. not_affected \u2014 The target version 1.7.14.RELEASE does not contain the vulnerability. While it receives the admin password credential (from RABBITMQ_TEST_ADMIN_PASSWORD environment variable) and performs RabbitMQ management aliveness checks, the exception message thrown on aliveness test failure is hardcoded and does not include the password value. The vulnerable pattern (password concatenated into exception m...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-59271"
      },
      "impact_statement": "not_affected \u2014 The target version 1.7.14.RELEASE does not contain the vulnerability. While it receives the admin password credential (from RABBITMQ_TEST_ADMIN_PASSWORD environment variable) and performs RabbitMQ management aliveness checks, the exception message thrown on aliveness test failure is hardcoded and does not include the password value. The vulnerable pattern (password concatenated into exception m..."
    }
  ]
}