{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d0f4f0e8-9193-5b89-b7ad-2574ccd58506", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-aspects", "purl": "pkg:maven/org.springframework.security/spring-security-aspects@3.2.8.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-aspects@3.2.8.RELEASE-tuxcare.1", "version": "3.2.8.RELEASE-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-security-aspects", "purl": "pkg:maven/org.springframework.security/spring-security-aspects@3.2.8.RELEASE", "type": "library", "group": "org.springframework.security", "version": "3.2.8.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:32c43627-bada-5770-9ed0-64147e63924a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2f69ff59-f674-5ee0-acb8-c427f52cbfa9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8fd117db-455b-54ac-99bd-c888b973e725", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:94e2d72a-801b-57ac-abcc-8b21e9c13a33", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:232affb0-ef25-5c14-9f84-961ba35eaa9e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b12fe687-5503-5905-af84-3ea59522b91f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:52edc713-2f3e-595a-a53e-4e74d45d3f51", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:72f1edb1-a4a6-5b5a-8a51-7cb5545d7b39", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:cd0586b2-897d-5d73-909a-0d2b9a4b86f2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6e611f1f-bf20-5c70-b331-0ae11c458b2d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:07c0e53d-3602-5a6a-9e4a-2c835375a6ed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:218a552b-f861-59ce-992c-1079b88911c1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1ea8be88-012a-53da-bd85-a54f35da3740", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-11272 is fixed in version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:463e629f-21d8-5c4e-8bce-366f5553edf3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e765f392-f502-5749-a561-eb74277f8ea1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:24248ce4-8c2f-52e2-8d9e-194c5c7746a2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f10484dd-d244-58de-85f4-fbe1397f820b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:84b092cc-1bb6-5700-a28c-c065d112b872", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3f57d762-d7a7-51a1-9c33-e8ef9a9fa311", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22978 is fixed in version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3694b63b-a36d-5c1c-a347-acf3a8aa99f8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3b8d38e0-d6ef-5cd0-9e58-0da3d1d7d7c4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7cd94a97-f23f-5781-82e1-fa4e50e96314", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4ade1545-6c3e-5c86-b8a7-99f4dd45091f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22257 is fixed in version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:bccb4593-d549-55d7-b7bf-b69833dae397", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5cd1a010-d912-59f8-9e51-f6d21dc4ac01", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38827 is fixed in version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9fa62e64-6e5c-5dbf-96fd-19707ec35477", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22223 does not affect version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects. not_affected \u2014 Spring Security 3.2.8.RELEASE is not affected by CVE-2025-22223. The vulnerability targets the modern method security architecture (`@EnableMethodSecurity` + `UniqueSecurityAnnotationScanner`) introduced in Spring Security 5.6+. Spring Security 3.2.8 uses a fundamentally different architecture (`@EnableGlobalMethodSecurity` + `PrePostAnnotationSecurityMetadataSource`) and lacks both the vulnera...", "justification": "code_not_present" } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9b3fff43-a2b3-54e3-8130-dc82500ac6cc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects. not_affected \u2014 CVE-2025-22234 is not present in Spring Security 3.2.8.RELEASE. This CVE is a secondary vulnerability that only manifests when CVE-2025-22228 is present. CVE-2025-22228 introduced a 72-byte password length check in BCrypt that inadvertently broke timing attack mitigation in DaoAuthenticationProvider. The target version does not have CVE-2025-22228 applied (no 72-byte limit exists in BCrypt.java...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:980183d8-69ab-5632-95ed-34cde3529829", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 3.2.8.RELEASE does not contain that scanner, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0afb8424-f15c-5c9f-9bef-37e804a1fd9d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41248 does not affect version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects. CVE-2025-41248 affects the annotation lookup used by @EnableMethodSecurity. Spring Security 3.2.8.RELEASE predates @EnableMethodSecurity, which was added in 5.6, and has no such lookup, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:643115be-6d9b-514c-b9e9-5ebe7c7b4f6a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:58e82ab3-975e-500d-9f13-c15255bbe53f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects. not_affected \u2014 Spring Security 3.2.8.RELEASE is not affected by CVE-2026-22751. The vulnerable JdbcOneTimeTokenService class and the entire one-time token authentication feature do not exist in this version. The one-time token (OTT) authentication feature was introduced in Spring Security 6.x (circa 2021-2022), while version 3.2.8.RELEASE dates from 2015. The target repository contains no code that processes ...", "justification": "code_not_present" } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:889d2543-ebdc-5118-87bf-9bfc628652cb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59276 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4f769e52-360e-5996-b7f2-8dcb5f46b251", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects. not_affected \u2014 Spring Security 3.2.8.RELEASE is NOT AFFECTED by CVE-2026-59277. The vulnerability requires the InetAddressMatchers utility class with matchInternal()/matchExternal() methods for classifying IP addresses as internal vs external. This feature does not exist in version 3.2.8.RELEASE. The target only has IpAddressMatcher for basic subnet matching, with no internal/external classification capabilit...", "justification": "code_not_reachable" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@3.2.8.RELEASE-tuxcare.1" } ] }