{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:98fee7ed-b6dd-5f5c-8e64-fd917f44a55c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-acl", "purl": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.17", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.17", "version": "6.3.10-tuxcare.17", "pedigree": { "ancestors": [ { "name": "spring-security-acl", "purl": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10", "type": "library", "group": "org.springframework.security", "version": "6.3.10" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:6f3f2e02-ed60-5163-94ee-594c890d1f8b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:58c54890-25a8-5be5-aadf-03582981fcb5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:915d185d-d9be-51bb-a7cd-0037c3ec0975", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:f871a9c7-500e-524c-b99a-7b003652ed71", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:55314409-ad85-5edc-a1e0-b7bc8f701e1b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:b611d1c8-5ab3-5fe5-ba0b-a238578e9c8c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:483f644e-8fd4-5d4b-9e44-bb9a5f8edd65", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:b3a72bf9-ca90-5a0a-b933-a011322c8584", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:361afce1-d1c0-5772-93b2-5bcad5921fab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:7fa41ba8-22b6-571f-9f9d-83ec8058c74e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:a04bad78-9a5f-5a18-af5c-a1016345981e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:49f5be7d-d0bb-5951-b069-65c5cee3fe2e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1258 does not affect version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-acl. not_affected \u2014 The target Spring Security 6.3.10-tuxcare.7 is not affected by CVE-2018-1258. The vulnerability existed in Spring Framework versions 5.0.5/5.0.6 and was fixed in Spring Framework 5.0.7 (June 2018). The target depends on Spring Framework 6.1.20-tuxcare.5, which is approximately 6 years newer than the fixed version and contains all security fixes from 5.0.7 onwards.", "justification": "requires_dependency" } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:f0e4e18f-dfe2-5a8a-8721-d8f6ebfdaa06", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:e5ba97fe-7f86-5b6d-a662-88d41c3b8f0b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:e5b0d706-db21-5869-bf70-19688d36ac54", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:d882f259-942d-5bd7-abfc-afb5ddb520a0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:7a1f928f-9477-5ae6-b1e7-af27a8f921c6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:6ea849d9-3a58-5d80-83d0-bb5e04270028", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:b0e2a44f-7689-5415-be9e-ce501a638b18", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:1cfe835a-207e-5162-9565-33037a0e89be", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:256cb65e-954b-5359-a719-79f7ab430f63", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:001a9416-bdf7-5ba3-afbe-046588bac4b1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:6d14ca85-a186-5096-a245-a11e01bf891b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:d7174146-811b-559a-a94b-1f714f8d97cb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22257 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:2962da80-bb16-58ab-b3b6-0a4bf88c5037", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:1c37a2cf-ad3d-504d-9393-d9a0992723f0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38827 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:3801c860-9a28-5412-bf40-2d6ee045b2fb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:732c1384-0a03-52c4-9d8a-31cbaca5ffe0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22228 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:b21c2f97-5ffc-5454-908b-20a62f70dade", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-acl. not_affected \u2014 The target repository (spring-security 6.3.10-tuxcare.21) is NOT AFFECTED by CVE-2025-22234. The vulnerability was fixed by upstream Spring Security in commit c1aa99fdd2113a232986e9c3a44673ae752de840 (dated 2025-04-17) before TuxCare onboarded version 6.3.10. The fix conditionalizes the 72-byte password length check to only apply when encoding new passwords (!for_check), not during authenticati...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:14c56189-081c-5f05-90da-aea840a30f63", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41232 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:955a3cd4-4581-5dfa-a395-2df70dc79436", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41248 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:deeafb03-99d9-5144-957f-e03d3382877a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:35adb2dd-2a3e-5dd3-a5b1-e11ce3959dbb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-acl. not_affected \u2014 Spring Security 6.3.10 is not affected by CVE-2026-22751. The vulnerable component JdbcOneTimeTokenService was introduced in version 6.4.0, which postdates this target version. The one-time token authentication feature does not exist in 6.3.10.", "justification": "code_not_present" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:944712d5-1b09-55ae-8141-dc2d3d7ab152", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47842 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-acl, and is fixed in 6.3.10-tuxcare.20." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:bcdc4140-57a5-5899-ab3a-60d692151d2d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59276 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-acl, and is fixed in 6.3.10-tuxcare.20." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:4358fa6e-54ac-58b0-b6c7-072dcbba0823", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-acl. not_affected \u2014 Spring Security 6.3.10 does not contain the InetAddressMatchers class or its matchInternal()/matchExternal() methods that are affected by CVE-2026-59277. The vulnerability concerns incorrect classification of \"any local\" addresses (0.0.0.0 and ::) as external rather than internal. This functionality was introduced in a later version of Spring Security (patches dated June/July 2026, after the 6....", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.17" } ] }