{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ca91f2bb-8779-5d2f-9423-c5a67f83aa9b", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-acl", "purl": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.19", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.19", "version": "6.3.10-tuxcare.19", "pedigree": { "ancestors": [ { "name": "spring-security-acl", "purl": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10", "type": "library", "group": "org.springframework.security", "version": "6.3.10" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:2790a301-a4c0-5af8-b2c4-f53cebbd34e5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:6a441d8b-2ec8-595a-b146-3cfdc93a6868", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:2535b6bc-fa47-5e4d-9a07-1b8c349f5fc9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:b4ce505d-5398-5826-8dbf-67dfeca57093", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:ac798e1f-8966-5529-80e0-89a814c031bc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:e29d3082-a78c-5b5d-b980-25c51c66cb0a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:8fdf0b6e-ecf3-5f4c-a084-58c42e428490", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:0cd1aeb1-256b-5e4e-9230-62b600072093", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:91166fa9-616d-5c8a-939e-6c962bada9e6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:93a2f28e-1b4a-55a0-8c8b-e35c714243b7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:6b789cad-3d23-5ee4-9816-97c27fb81016", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:1a842a54-0f6f-5585-a500-5e3857d70b77", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1258 does not affect version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-acl. not_affected \u2014 The target Spring Security 6.3.10-tuxcare.7 is not affected by CVE-2018-1258. The vulnerability existed in Spring Framework versions 5.0.5/5.0.6 and was fixed in Spring Framework 5.0.7 (June 2018). The target depends on Spring Framework 6.1.20-tuxcare.5, which is approximately 6 years newer than the fixed version and contains all security fixes from 5.0.7 onwards.", "justification": "requires_dependency" } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:c9ba91d0-170a-5c8d-95a5-e08aa3dda331", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:18a44897-f540-54a4-a313-886086d5aafc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:10db47f7-4284-5efd-ad19-e52ef0caa732", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:77b51455-a72d-596c-ae18-735abadbb3bb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:3f7c8a46-cbce-53f4-a4ea-6df670725ab2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:56179c13-f207-54eb-8de9-1da6560a25df", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:135880fd-7ddf-5d60-a029-7ad15964d346", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:5af7e7a3-f223-534c-8f56-536fa89221ab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:f9694f73-14e1-5c1c-8c34-a3d70a07aecb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:25970525-e7c8-5316-8488-7350605c0f8f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:c42125f7-07ce-5f4f-8329-d5734bf89dde", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:704b6489-ff12-5d0e-a3b7-c12129425d9f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22257 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:827312d3-3511-59a2-98ea-728136347987", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:93d7e5f7-7d8c-5e11-b654-d405da26161c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38827 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:5b8ee8c5-7632-52f8-ada8-8d6c1c56f519", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:1f076c5b-ff10-5197-b44d-c44bedd1614a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22228 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:24295840-56ee-5bab-b4af-6b2308708946", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-acl. not_affected \u2014 The target repository (spring-security 6.3.10-tuxcare.21) is NOT AFFECTED by CVE-2025-22234. The vulnerability was fixed by upstream Spring Security in commit c1aa99fdd2113a232986e9c3a44673ae752de840 (dated 2025-04-17) before TuxCare onboarded version 6.3.10. The fix conditionalizes the 72-byte password length check to only apply when encoding new passwords (!for_check), not during authenticati...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:d996d561-d78a-5ab7-9898-83320338ddea", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-acl. Spring Security 6.3.10 contains a copy of the pre-fix method lookup from a TuxCare backport, but it is only used together with Spring's own annotation lookup, which finds annotations on private methods, so the CVE-2025-41232 authorization bypass cannot occur.", "justification": "code_not_reachable" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:2dd51b07-6844-5b7b-a025-eb7f3a5801a3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41248 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:2dff436b-a69e-5582-a09a-3efff9617e60", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:638ec920-a186-52f6-a77a-e236b606193a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-acl. not_affected \u2014 Spring Security 6.3.10 is not affected by CVE-2026-22751. The vulnerable component JdbcOneTimeTokenService was introduced in version 6.4.0, which postdates this target version. The one-time token authentication feature does not exist in 6.3.10.", "justification": "code_not_present" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:1a77ddfb-d837-5676-88fb-279f1f33775c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47842 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-acl, and is fixed in 6.3.10-tuxcare.20." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:ba41d241-1144-5723-be1c-e6ab012ea696", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59276 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-acl, and is fixed in 6.3.10-tuxcare.20." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:3da6a74d-298f-55e3-8ea1-08cf0e94c4b1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-acl. not_affected \u2014 Spring Security 6.3.10 does not contain the InetAddressMatchers class or its matchInternal()/matchExternal() methods that are affected by CVE-2026-59277. The vulnerability concerns incorrect classification of \"any local\" addresses (0.0.0.0 and ::) as external rather than internal. This functionality was introduced in a later version of Spring Security (patches dated June/July 2026, after the 6....", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.19" } ] }