{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:142c1b1b-8eb7-5891-86e2-a6487fedd1f3", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-aspects", "purl": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.1", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.1", "version": "5.7.7-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-security-aspects", "purl": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7", "type": "library", "group": "org.springframework.security", "version": "5.7.7" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:27f67a5c-ee31-5f81-9f45-455d77d5dc48", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:50c50d2a-cf78-5726-8842-1d145161efe6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:9129504d-639f-5556-976d-14a1642bbf06", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:d47d87bb-079f-5987-9ed4-f9dcf5d70211", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:dd221b64-8cd9-5089-8eb4-9168a1306d02", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:edbc50c2-36f1-5d11-b997-3b8b1d40d370", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:21666ace-c413-52b2-bbcd-b438386046ed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:2a13677e-0864-5a88-9fe6-40f889ecc968", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:5f2668e4-3bfa-564e-97e6-2bfa749d02b8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:0ab0e9a4-7cca-5578-99ee-945c9e3cdc9d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:d85408c4-d083-5e36-a48e-009d22686ff1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:ed94b9bf-b1ec-56e1-829e-711defa51501", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:cc2c4bef-d7ca-577d-bc0f-24fce49bbd5b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:fab69fd4-f6a9-5422-a561-ef0e0b1697ff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:32f03e3b-3a15-5d66-a6d9-67164a6cd278", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:9b1f86f6-787f-5862-ba33-f0627de416b0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:d112568f-b6e4-5489-b181-4d4cfa977ef2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:7b79c823-9924-5b23-9e24-cf83c546e07f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:dad2e976-c153-5129-a071-038c1e486133", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:7cb957bc-bd2e-5bd1-8242-81910747a7c7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:8b899f73-1953-55b8-9095-8ba35523ecbb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:8b405909-c786-55f9-92e0-799abca2f8f1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:19d5aa77-334f-5ed8-9eb9-ca7dd62f4f83", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22257 is fixed in version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:db2c1d2a-818e-5095-ae9c-0fd2bb1243cc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:98488945-fff7-5758-8da6-a98a894ecdc1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38827 is fixed in version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:950c28d6-82e3-54b2-aa40-669defd5bec5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:efecd4a8-e2c9-57f7-96c7-5dda610d58d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22228 is fixed in version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:fa0cfbff-f162-527b-9cdb-b29e78f0cfdf", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-aspects. not_affected \u2014 Spring Security 5.7.7 is not affected by CVE-2025-22234. This CVE is a secondary vulnerability introduced by the fix for CVE-2025-22228, which added a password length check to BCrypt that broke timing attack mitigation. The target version (5.7.7) never received the CVE-2025-22228 fix, and therefore does not contain the problematic code that causes CVE-2025-22234. The timing attack mitigation in...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:a72ac571-0c2d-5d4c-bd17-997ca1dde7c5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-aspects. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.7.7 does not contain that scanner, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:1c9e1fb3-547a-501b-abeb-c430088ef9ec", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41248 does not affect version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-aspects. Spring Security 5.7.7 has no generic-type annotation matching of its own: method security looks annotations up through Spring Framework's annotation utilities, so the CVE-2025-41248 code is not present. The equivalent issue in Spring Framework is tracked as CVE-2025-41249.", "justification": "code_not_present" } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:d440f00e-e3a9-518b-9131-abd076ba6893", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:4245c254-b066-5c27-a65b-8d63ef0aab78", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-aspects. not_affected \u2014 Spring Security 5.7.7 is not affected by CVE-2026-22751 because the vulnerable component (JdbcOneTimeTokenService) does not exist in this version. The One-Time Token (OTT) authentication feature was introduced in Spring Security 6.4.0, and version 5.7.7 predates this feature entirely. Comprehensive searches across the codebase found no JdbcOneTimeTokenService class, no OneTimeToken-related code...", "justification": "code_not_present" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:9475ada9-778b-5096-b832-bb662946b45b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47842 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-aspects, and is fixed in 5.7.7-tuxcare.2." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:7eefd40b-eab9-5274-8c90-88d7f87504dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59276 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-aspects, and is fixed in 5.7.7-tuxcare.2." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:d4e71844-9e4d-5a00-a01a-59b88deda62b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-aspects. not_affected \u2014 Spring Security 5.7.7 is not affected by CVE-2026-59277. The vulnerable component, the InetAddressMatchers utility class with matchInternal()/matchExternal() builders for classifying IP addresses as internal or external networks, does not exist in this version. The CVE describes a misclassification vulnerability where 0.0.0.0 and :: are incorrectly treated as external addresses. However, versio...", "justification": "code_not_reachable" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.1" } ] }