{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6a262af8-3301-5fab-b232-5a2c4e737355", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-acl", "purl": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.2", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.2", "version": "5.7.7-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-security-acl", "purl": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7", "type": "library", "group": "org.springframework.security", "version": "5.7.7" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:8485af67-f611-535f-8138-c2ff8483e48d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:06a7ad20-25a9-50c0-af49-0b271684a2ef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:01839cc8-5609-5dd3-a712-f1d933c23267", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:3dd0cafb-6dc1-5770-8dd1-77aac57add09", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:7eec2397-c8ef-554c-b071-eaa979ebf439", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:a666b6c7-d1d0-58ed-babf-8ab1154b81f7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:2f40210c-bffa-57fe-acae-cef44e5ab3fc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:88f716ca-3ef0-5f57-9926-13542fabdd54", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:32313d60-e7ac-5e5d-8292-7fc3e24ad947", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:7f9a0ea2-4c1b-5187-ad6c-06d7364d80d8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:bc6e2319-0fd9-5da6-95bc-f22e2c1c522a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:035e3129-782d-508d-b4c6-81c5dd5e508c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:f3e61a05-87a1-505c-98eb-3fcd0ae50e84", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:e9ddb119-22c6-537e-b617-3a76e70830e6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:aef9a1ed-9b09-54cc-a668-30f7a9c4aab8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:9cdce380-4d90-5e52-bd5b-8f7f1320ee68", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:8fe00736-7839-591f-9eac-943bd428dc46", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:786a31c8-fabc-5d4f-b1dd-0154d46875a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:98c689cf-bad9-520c-84e9-cb23b4e5b479", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:6d948a7b-e9b4-55fb-b361-76ba0e7f1abc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:064b1146-bef5-5c5a-93d2-3254479bbc8d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:88681608-a56e-5527-9ed2-6f0d151b3988", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:9943301d-c5bb-5baf-9e26-41fbdb306a8d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22257 is fixed in version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:52009f53-7152-51ce-b614-a0392cea4025", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:0bf1f632-4205-5389-8771-b55b59607cef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38827 is fixed in version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:a28ed7ce-a45b-5008-abfb-9cdb5881a4b2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:954af7fc-95b6-55b4-b960-f2d8ab6e3d21", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22228 is fixed in version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:5e3d8021-b7a7-547a-a160-7058094acf62", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-acl. not_affected \u2014 Spring Security 5.7.7 is not affected by CVE-2025-22234. This CVE is a secondary vulnerability introduced by the fix for CVE-2025-22228, which added a password length check to BCrypt that broke timing attack mitigation. The target version (5.7.7) never received the CVE-2025-22228 fix, and therefore does not contain the problematic code that causes CVE-2025-22234. The timing attack mitigation in...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:fc241c71-b5c8-5d64-b4c8-04c40f0d8fd4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-acl. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.7.7 does not contain that scanner, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:87d9417d-0dff-552a-9d6a-c010b6c7c8df", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41248 does not affect version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-acl. Spring Security 5.7.7 has no generic-type annotation matching of its own: method security looks annotations up through Spring Framework's annotation utilities, so the CVE-2025-41248 code is not present. The equivalent issue in Spring Framework is tracked as CVE-2025-41249.", "justification": "code_not_present" } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:dd9b0c8e-b944-5d2c-b13b-02e138be5b61", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:8e111858-4993-53c3-998d-4756bd26c13a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-acl. not_affected \u2014 Spring Security 5.7.7 is not affected by CVE-2026-22751 because the vulnerable component (JdbcOneTimeTokenService) does not exist in this version. The One-Time Token (OTT) authentication feature was introduced in Spring Security 6.4.0, and version 5.7.7 predates this feature entirely. Comprehensive searches across the codebase found no JdbcOneTimeTokenService class, no OneTimeToken-related code...", "justification": "code_not_present" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:88afe898-1a0c-547e-8088-4b643bccdbc0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:1c7234e6-2b35-5846-bc78-bfed26d37fa0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:7686f598-9b5b-596c-9b8c-011b7a887014", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-acl. not_affected \u2014 Spring Security 5.7.7 is not affected by CVE-2026-59277. The vulnerable component, the InetAddressMatchers utility class with matchInternal()/matchExternal() builders for classifying IP addresses as internal or external networks, does not exist in this version. The CVE describes a misclassification vulnerability where 0.0.0.0 and :: are incorrectly treated as external addresses. However, versio...", "justification": "code_not_reachable" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.2" } ] }