{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3700a6d6-1a9d-5c07-903e-838f06f498fd", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-acl", "purl": "pkg:maven/org.springframework.security/spring-security-acl@3.2.8.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-acl@3.2.8.RELEASE-tuxcare.1", "version": "3.2.8.RELEASE-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-security-acl", "purl": "pkg:maven/org.springframework.security/spring-security-acl@3.2.8.RELEASE", "type": "library", "group": "org.springframework.security", "version": "3.2.8.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:916a1bde-05a1-55ee-b835-dc3106e20574", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9d5cee1b-ec46-5d37-b9f1-24c841b84cbd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:101a1e4c-2953-5953-ab6d-040fb7b35227", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ad55c09b-07b0-5dc7-b2e0-7520504f43e0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:237537e8-1acf-5626-ae98-2534b4780cd7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d321b4c7-3cb0-5429-8587-9ad60f01e19c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c7efd00b-91e2-5c7a-a10a-d8cd2c44450b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a7ce1620-887b-584d-8887-fa717a751d8c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:de54ec62-31e2-542a-a304-bb82ac3d6f58", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:28e109bc-1c23-5693-9be9-0eda17387ed9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7ed2ce7c-880d-5f4f-a2a5-f7eca3635b4a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0c1a23f7-b885-58a5-9361-ed66973f3699", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f16e6a63-5afe-58d5-b1ad-b7aa033c7ad7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-11272 is fixed in version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b732540e-51c7-5e8f-9a34-1c23a7a8a630", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d0a4f2df-8e80-5db8-947c-1e82ca8771ba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f0c5a4b8-315d-5648-92dc-d256c0a6953a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9ef6b3be-46b9-513d-af9b-e56c07b20892", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:fbb085c7-bb5e-52b9-8272-a3f70c7f5a0a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:49fbcbc2-4122-501b-b520-2130b404d472", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22978 is fixed in version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1cb466c9-5d0d-5a68-adda-e1e4157674ca", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e98e572f-b04c-50b3-8603-b3e5f536ffbb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:44793d5a-89cc-5c7e-8984-a71e7846db61", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9a83b1ae-01ba-5eca-9c4c-17ff24cb2894", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22257 is fixed in version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:996b7f02-41b3-5ae5-a9df-c5a58f108d32", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b68fe7a3-d97f-552c-96dd-18407001da5a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38827 is fixed in version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4af06682-c221-590a-bd7c-93282bcd0e93", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22223 does not affect version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl. not_affected \u2014 Spring Security 3.2.8.RELEASE is not affected by CVE-2025-22223. The vulnerability targets the modern method security architecture (`@EnableMethodSecurity` + `UniqueSecurityAnnotationScanner`) introduced in Spring Security 5.6+. Spring Security 3.2.8 uses a fundamentally different architecture (`@EnableGlobalMethodSecurity` + `PrePostAnnotationSecurityMetadataSource`) and lacks both the vulnera...", "justification": "code_not_present" } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f7b1fd47-1542-5510-ba4d-50758b50469b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl. not_affected \u2014 CVE-2025-22234 is not present in Spring Security 3.2.8.RELEASE. This CVE is a secondary vulnerability that only manifests when CVE-2025-22228 is present. CVE-2025-22228 introduced a 72-byte password length check in BCrypt that inadvertently broke timing attack mitigation in DaoAuthenticationProvider. The target version does not have CVE-2025-22228 applied (no 72-byte limit exists in BCrypt.java...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:543496fa-cb0f-50cc-946d-2c44f3a3865a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 3.2.8.RELEASE does not contain that scanner, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:eac3dabb-5947-54e1-ba5e-7f9effd2af50", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41248 does not affect version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl. CVE-2025-41248 affects the annotation lookup used by @EnableMethodSecurity. Spring Security 3.2.8.RELEASE predates @EnableMethodSecurity, which was added in 5.6, and has no such lookup, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ae342a63-ff8d-5a23-a5a1-e33931fe0457", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:34a3a79c-574d-57c0-aec7-08d9a49b8091", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl. not_affected \u2014 Spring Security 3.2.8.RELEASE is not affected by CVE-2026-22751. The vulnerable JdbcOneTimeTokenService class and the entire one-time token authentication feature do not exist in this version. The one-time token (OTT) authentication feature was introduced in Spring Security 6.x (circa 2021-2022), while version 3.2.8.RELEASE dates from 2015. The target repository contains no code that processes ...", "justification": "code_not_present" } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7eaeb2c7-0e77-58ae-974f-d5f4a1a960f4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59276 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3d927110-b316-5855-bc11-83d4de7d7aee", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl. not_affected \u2014 Spring Security 3.2.8.RELEASE is NOT AFFECTED by CVE-2026-59277. The vulnerability requires the InetAddressMatchers utility class with matchInternal()/matchExternal() methods for classifying IP addresses as internal vs external. This feature does not exist in version 3.2.8.RELEASE. The target only has IpAddressMatcher for basic subnet matching, with no internal/external classification capabilit...", "justification": "code_not_reachable" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@3.2.8.RELEASE-tuxcare.1" } ] }