{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:308f5945-4324-54e9-81cb-1c92ae6790e5", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-aspects", "purl": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.5.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.5.RELEASE-tuxcare.1", "version": "5.1.5.RELEASE-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-security-aspects", "purl": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.5.RELEASE", "type": "library", "group": "org.springframework.security", "version": "5.1.5.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c28f7915-7293-5894-8934-a04d0a8a1f53", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f7395e3f-0cfe-5f8b-8372-1b6e9f3099c2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2b5ed745-35e0-5f80-9c3c-c6d9c22dac24", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a044533b-e31a-5b78-9d3d-8fc0280eb1b1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:41a51b65-83d7-58bd-9d9a-2b820d19891c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d8fceade-594f-542d-9cf5-4cf3272ce41d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:01ec6816-b5be-5544-a8c1-52fd94cad2b4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:075f5602-831e-5fad-a5cf-6d1079852090", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:168fc2a8-0874-5909-a2b0-3cbc50593ae4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9da8bc49-aa7f-5637-a5f2-9e7b5ade8d54", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6551c2e3-2789-51e6-80ca-308e092ccd06", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:fbc74349-2d90-5472-89f2-e47bfaaa3420", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4093e477-1516-5aa3-9bfa-0fdc5bdee792", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a5578cf5-a33f-50b4-ac3b-9dc969508201", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-3795 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects. not_affected \u2014 The target repository (Spring Security 5.1.5.RELEASE-tuxcare.1) is NOT AFFECTED by CVE-2019-3795. The vulnerability involved insecure randomness when SecureRandomFactoryBean#setSeed was used to configure a SecureRandom instance - specifically, calling setSeed() before any random bytes were generated would cause the user-provided seed to REPLACE the entire internal RNG state rather than suppleme...", "justification": "code_not_present" } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:af8ef76c-23f9-5bc0-884b-2b9585d037c7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:aa300d05-7cbb-5962-9163-80983892c062", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:201064c2-9890-5088-b773-738c5e9057b2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:492d2904-ea0b-572a-8f5f-fb606334ae9d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:03349a62-9fc7-55b4-aa3e-4a142673f704", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22978 is fixed in version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3a60e0fc-a66c-59aa-afe3-ffd8a92af449", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6aca0936-e5a0-5e87-be57-996dd3da0e4b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2b391e5e-5092-526a-a070-5bbea7acf015", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d985231c-bab8-53ac-8485-b5f5a684c5e0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22257 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:bcae455c-cee5-5d3b-9bd2-4b4bd98f09b6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:797b44c4-e930-5019-98e9-17b19d471099", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38827 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:906dc08f-8a76-5114-9085-ef90543f6523", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22223 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects. not_affected \u2014 Spring Security 5.1.5.RELEASE is not affected by CVE-2025-22223. The vulnerability requires @EnableMethodSecurity and the UniqueSecurityAnnotationScanner class, both introduced in Spring Security 6.0.0. Version 5.1.5 uses @EnableGlobalMethodSecurity with PrePostAnnotationSecurityMetadataSource, which relies on Spring Framework's ClassUtils.getMostSpecificMethod() to correctly resolve annotation...", "justification": "code_not_present" } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:26bfce10-78c3-5d6e-aedc-089353d9fd2f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects. not_affected \u2014 Target version 5.1.5.RELEASE is not affected by CVE-2025-22234. This CVE fixes a timing attack vulnerability introduced by CVE-2025-22228, which added an unconditional 72-byte password length check that broke timing attack mitigation in DaoAuthenticationProvider. The target does not have CVE-2025-22228 applied, therefore it cannot have the timing oracle vulnerability that CVE-2025-22234 address...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:613f76d5-33c9-59bd-81db-ab89ec633504", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.1.5.RELEASE does not contain that scanner, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1865d52a-c8d3-5558-becb-e3d3b1fef959", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41248 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects. CVE-2025-41248 affects the annotation lookup used by @EnableMethodSecurity. Spring Security 5.1.5.RELEASE predates @EnableMethodSecurity, which was added in 5.6, and has no such lookup, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:feaf962d-b2ff-5515-84a7-e95be337dcc2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:fc16194d-2cc9-518a-b261-e7ca2de05242", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects. not_affected \u2014 Spring Security 5.1.5.RELEASE does not contain the One-Time Token (OTT) authentication feature. The vulnerable component JdbcOneTimeTokenService was introduced in version 6.3.x, several major versions after 5.1.5. The target codebase does not process one-time authentication tokens and therefore cannot be affected by the TOCTOU race condition described in CVE-2026-22751.", "justification": "code_not_present" } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5f3b39a3-aa4a-5ee5-8eee-bda6ec066dd3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7dd8a036-3a69-571d-8754-fa0fa2244220", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-aspects. not_affected \u2014 Spring Security 5.1.5.RELEASE does not contain the InetAddressMatchers utility class that is the subject of CVE-2026-59277. The vulnerability concerns the matchInternal() and matchExternal() builders of InetAddressMatchers failing to recognize 0.0.0.0 and :: as internal addresses. Exhaustive search confirms this class, its methods, and the org.springframework.security.util.matcher package do no...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.5.RELEASE-tuxcare.1" } ] }