{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:97c189b4-8462-527a-b05e-46028000142e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-aspects", "purl": "pkg:maven/org.springframework.security/spring-security-aspects@5.5.8-tuxcare.1", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.5.8-tuxcare.1", "version": "5.5.8-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-security-aspects", "purl": "pkg:maven/org.springframework.security/spring-security-aspects@5.5.8", "type": "library", "group": "org.springframework.security", "version": "5.5.8" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.5.8-tuxcare.1" } ], "bom-ref": "urn:uuid:e250011b-951d-5a68-b097-03cc295eac8e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.5.8-tuxcare.1" } ], "bom-ref": "urn:uuid:56bb9484-89fb-5c22-b729-564b0c416654", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.5.8-tuxcare.1" } ], "bom-ref": "urn:uuid:dc2320bc-5a6c-5c8e-9f69-6e072394dfc5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.5.8-tuxcare.1" } ], "bom-ref": "urn:uuid:dd1013ba-0119-5158-9e19-adfcec6a2eb3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.5.8-tuxcare.1" } ], "bom-ref": "urn:uuid:70a6cbec-d842-574b-b9c3-244941951012", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.5.8-tuxcare.1" } ], "bom-ref": "urn:uuid:98787822-8ae6-5baf-ad83-d1999ec3a22d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.5.8-tuxcare.1" } ], "bom-ref": "urn:uuid:fe7cba50-3521-59c5-95eb-1f1c86223a7c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.5.8-tuxcare.1" } ], "bom-ref": "urn:uuid:0e256e55-c005-5b9a-9b7d-79914ada8bf1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.5.8-tuxcare.1" } ], "bom-ref": "urn:uuid:2110c8b4-8726-5eef-9c1f-97e9623129cc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.5.8-tuxcare.1" } ], "bom-ref": "urn:uuid:c0d52222-191e-5bcd-9e45-2a73f45aa41b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.5.8-tuxcare.1" } ], "bom-ref": "urn:uuid:bf6de658-d9a8-51c8-bd82-5e694e412de7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.5.8-tuxcare.1" } ], "bom-ref": "urn:uuid:7669c35b-b2ae-537c-92f0-9cdb4b088800", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.5.8-tuxcare.1" } ], "bom-ref": "urn:uuid:a1fe02b1-d29e-501f-aa50-1253a0747993", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.5.8-tuxcare.1" } ], "bom-ref": "urn:uuid:64ca5174-0667-58c5-bcf5-0f14078d11ca", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.5.8-tuxcare.1" } ], "bom-ref": "urn:uuid:b27d7fcc-31c7-5772-a1bf-8bb418472ec6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.5.8-tuxcare.1" } ], "bom-ref": "urn:uuid:002ae521-810c-567a-9224-1c61320026bc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5408 does not affect version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-aspects. not_affected \u2014 Target is Spring Security 5.5.8 (official upstream release), newer than every CVE-2020-5408 affected range (fix landed in 5.3.2/5.2.4/5.1.10/5.0.16/4.2.16). CVE-2020-5408: Encryptors.queryableText() uses a fixed all-zero (null) IV with AES-CBC, producing deterministic ciphertext that lets an attacker with read access to stored ciphertext derive plaintext via dictionary/frequency attacks. The vendor's fix (the exact input patch, commit db155b3094 \"Clean up Javadoc\") did NOT add a random IV \u2014 doing so would break the deterministic-query feature \u2014 it instead DEPRECATED the queryableText() method with the note \"This encryptor is not secure. Instead, look to your data store for a mechanism to query encrypted data.\" That deprecation is present in the target: Encryptors.java lines 103-107 carry @deprecated + @Deprecated on queryableText(), and commit db155b3094 is confirmed an ancestor of HEAD. Per Rule 3 (trust vendor fix intent), deprecation is the authoritative fix and must not be deemed \"insufficient.\" The fix commit is authored by Eleftheria Stein (upstream Spring, not TuxCare/CloudLinux), and HEAD (5.5.8) is an upstream release by sriesenberg@vmware.com \u2014 so this is the UPSTREAM-fix sub-case of not_affected (justification code_not_present), not already_fixed. Patch 2 (d1909ec, BCryptPasswordEncoder null-check) is unrelated to this CVE. [VC re-run with claude-opus-4-8, prod prompt pin d46bd7a, 2026-09-16; Sonnet run failed the author gate (A2 onboarding-merge overclaim); applied manually after git verification]", "justification": "code_not_present" } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.5.8-tuxcare.1" } ], "bom-ref": "urn:uuid:9b2ec13f-e0ff-536c-a39c-a759bac33694", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.5.8-tuxcare.1" } ], "bom-ref": "urn:uuid:da898759-9529-5501-9de0-b09911b6bd2a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.5.8-tuxcare.1" } ], "bom-ref": "urn:uuid:b2e6cba8-d00c-53fd-aff0-6131c143b8e0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.5.8-tuxcare.1" } ], "bom-ref": "urn:uuid:be79bff2-0d99-541b-9baf-d7b131db49da", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.5.8-tuxcare.1" } ], "bom-ref": "urn:uuid:59451436-198d-519b-ae0d-f7d1245a27cd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.5.8-tuxcare.1" } ], "bom-ref": "urn:uuid:5ba2d61a-a3c1-54a7-acde-8d91793e2f02", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.5.8-tuxcare.1" } ], "bom-ref": "urn:uuid:b061b673-730d-5703-8e0f-40d6b0615d15", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22257 is fixed in version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.5.8-tuxcare.1" } ], "bom-ref": "urn:uuid:a7f85374-b423-5c23-a763-2f2a5413a4a5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.5.8-tuxcare.1" } ], "bom-ref": "urn:uuid:66ac6c5c-04e6-559a-bf7e-696ec895f332", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38827 is fixed in version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.5.8-tuxcare.1" } ], "bom-ref": "urn:uuid:63980f15-f742-56c4-b23b-b22b81ecc166", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22223 does not affect version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-aspects. not_affected \u2014 Spring Security 5.5.8 is not affected by CVE-2025-22223. This vulnerability specifically affects Spring Security 6.0+ systems using @EnableMethodSecurity, where the UniqueSecurityAnnotationScanner class fails to resolve generic type parameters correctly. Version 5.5.8 does not have @EnableMethodSecurity or UniqueSecurityAnnotationScanner\u2014it uses the older @EnableGlobalMethodSecurity infrastruct...", "justification": "code_not_present" } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.5.8-tuxcare.1" } ], "bom-ref": "urn:uuid:6558c04a-0ea5-51e7-af91-016b56c51047", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22228 is fixed in version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.5.8-tuxcare.1" } ], "bom-ref": "urn:uuid:30e2ce22-132c-5ae6-af97-e4c1654de625", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-aspects. not_affected \u2014 Spring Security 5.5.8 (released May 2022) does NOT contain CVE-2025-22234. This CVE is a regression bug introduced by patch 1 (commit c1aa99fdd2, April 2025) which added conditional 72-byte password length enforcement to BCrypt that inadvertently broke timing attack mitigation in DaoAuthenticationProvider. The target repository lacks this conditional check entirely\u2014BCrypt.java contains no passw...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.5.8-tuxcare.1" } ], "bom-ref": "urn:uuid:e8468501-979b-5d57-8c9b-a112779ddf40", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-aspects. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.5.8 does not contain that scanner, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.5.8-tuxcare.1" } ], "bom-ref": "urn:uuid:484b230e-a7ce-54f3-bae2-8af124a146f9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41248 does not affect version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-aspects. CVE-2025-41248 affects the annotation lookup used by @EnableMethodSecurity. Spring Security 5.5.8 predates @EnableMethodSecurity, which was added in 5.6, and has no such lookup, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.5.8-tuxcare.1" } ], "bom-ref": "urn:uuid:1ad6986c-be45-5fc4-b3ee-b63813405810", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.5.8-tuxcare.1" } ], "bom-ref": "urn:uuid:5ec5e03b-dba1-50f5-8cd8-0c6f2395c430", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-aspects. not_affected \u2014 Spring Security 5.5.8-tuxcare.2 does not contain the vulnerable JdbcOneTimeTokenService class or the One-Time Token (OTT) authentication feature. The OTT feature was introduced in later versions (6.5.x+) and does not exist in version 5.5.8. Exhaustive searches confirmed no OTT-related code, classes, or packages are present in the target.", "justification": "code_not_present" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.5.8-tuxcare.1" } ], "bom-ref": "urn:uuid:57c0842a-6627-53c6-8dfd-b6d22601d8be", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47842 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-aspects, and is fixed in 5.5.8-tuxcare.2." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.5.8-tuxcare.1" } ], "bom-ref": "urn:uuid:4030eb64-d4ff-5faf-8489-93620d49ef51", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59276 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-aspects, and is fixed in 5.5.8-tuxcare.2." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.5.8-tuxcare.1" } ], "bom-ref": "urn:uuid:cebf0849-d6c0-5941-86b0-6c90d30d8236", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-aspects. not_affected \u2014 Spring Security 5.5.8 is not affected by CVE-2026-59277. The vulnerable InetAddressMatchers class with matchInternal()/matchExternal() methods does not exist in this version. This class was introduced in Spring Security 7.1.x, multiple major versions after 5.5.8. The target version only contains IpAddressMatcher, which matches specific IP addresses or CIDR ranges but does not perform internal/e...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.5.8-tuxcare.1" } ] }