{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:9361ec2b-f122-57cf-a813-0aa9cad40743", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-aspects", "purl": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.6.RELEASE-tuxcare.2", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.6.RELEASE-tuxcare.2", "version": "5.1.6.RELEASE-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-security-aspects", "purl": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.6.RELEASE", "type": "library", "group": "org.springframework.security", "version": "5.1.6.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2dd01405-7826-5ace-b06d-6fad36799dcd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:758d575b-2864-572e-8b68-3f7d307a4bd3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9bc92990-a000-559c-8ca0-645fde8613c5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b68f39d3-15bf-5d2d-ad58-eaff27d1c858", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:72b48288-816a-5d2f-bbd5-d4026798f88e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e5dfe12a-4e19-5c6f-8348-1b2bc70f2534", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ca1373b5-c295-5db6-a06e-aae4dc16e38d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2d7efc1a-d13e-51a5-b1ef-f5633a91a006", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a277c4f8-2298-541d-a744-d6643fa0fb50", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e26a2300-263c-539b-94a8-4e9841a0e65d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0eda6939-98dd-5c71-b743-3590d90c09d3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4b352dd7-2bcd-5a45-87a7-5891a4ba5878", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4b7f9576-3db8-5a58-920f-4d7069541e26", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:837e5433-847a-5451-938b-658b9dd8aa78", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6db4b7be-7b2f-513f-9b8c-7bd4f29be086", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:173f098f-a27c-5631-9beb-73da4ebc7d92", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0661e3ae-fa45-52af-9f87-1bd437c996ef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0df383d8-7334-525c-b900-887c48692833", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:abbdc955-7b3e-5587-bb7f-8f14b5dac4e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22978 is fixed in version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bd0e5608-7eec-566e-aa15-0a8999ede762", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9049d999-d150-53e6-a878-55bd18cdff45", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:fb3850f0-e177-5608-aa15-8c7e30187d3e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1d068d33-704e-5587-9a6d-72eb4c853744", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22257 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bfa8b5ef-ebb4-5fa7-87e3-6127ce8b158b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bcb1a149-0afe-503d-ad82-9343db9b0d0e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38827 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:761f5a06-4875-57e1-97a4-bb4308e5a6e3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22223 does not affect version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-aspects. not_affected \u2014 Spring Security 5.1.6.RELEASE does not contain the vulnerable code. CVE-2025-22223 specifically affects applications using @EnableMethodSecurity (introduced in Spring Security 5.6+), which resolves method security annotations via UniqueSecurityAnnotationScanner. Version 5.1.6 uses the older @EnableGlobalMethodSecurity API with PrePostAnnotationSecurityMetadataSource, a completely different impl...", "justification": "code_not_present" } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:58d90dde-adb8-5356-ad9e-70ddd36957fd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-aspects. not_affected \u2014 The target spring-security 5.1.6.RELEASE is NOT affected by CVE-2025-22234. This CVE addresses a timing attack vulnerability that was inadvertently introduced by the CVE-2025-22228 fix. However, 5.1.6.RELEASE never received the CVE-2025-22228 backport, so the vulnerable code pattern (unconditional 72-byte password length check in BCrypt.hashpw that breaks DaoAuthenticationProvider's timing atta...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3778b5d5-6c44-55b4-acbb-a0e8d59ef76a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41232 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:96366b3b-1603-5980-9a46-32dd8163f24a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41248 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8deb30fa-788e-572a-b2f1-71f95600f900", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ed9ced6c-8067-570a-b617-63883668da80", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-aspects. not_affected \u2014 Spring Security 5.1.6.RELEASE-tuxcare.2 is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService and the entire One-Time Token authentication feature) was introduced in Spring Security 6.4.0-M4 (July 2024), long after the 5.1.6 release. The target version does not contain the vulnerable code, cannot process one-time token authentication requests, and lacks the authen...", "justification": "code_not_present" } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3f19123d-1c71-5a5c-a18b-b801930bd1e9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f48a52b5-a500-573a-a7af-a6229b76d79b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-aspects. not_affected \u2014 Spring Security 5.1.6.RELEASE-tuxcare.2 is not affected by CVE-2026-59277. The vulnerable component InetAddressMatchers (with matchInternal() and matchExternal() methods) does not exist in this version. The class was introduced in later versions of Spring Security. Version 5.1.6 only contains IpAddressMatcher, a CIDR-based subnet matcher without internal/external IP classification capabilities,...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.1.6.RELEASE-tuxcare.2" } ] }