{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2ca40546-82f2-5621-adc4-9854146a47d7", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-aspects", "purl": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.3", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.3", "version": "5.7.7-tuxcare.3", "pedigree": { "ancestors": [ { "name": "spring-security-aspects", "purl": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7", "type": "library", "group": "org.springframework.security", "version": "5.7.7" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:25334c9d-a7e5-5543-8780-8acfb2e02431", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:87b767cc-e84f-5051-8dbf-c5f149523b4b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:f8b66c1d-1197-59d3-b88b-975394ac14f5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:085208ea-5b50-5180-b9c3-22dad0dea4a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:10ddc1c4-c0bc-5131-89f5-6c3812b2979b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:c204c629-0213-5722-8f7d-c51bae29e305", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:ca177fd3-765a-5425-9337-1414528e1aff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:521fdd32-fe81-576b-8c3e-283b8c8b0bc2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:917282bd-a268-569c-a2df-0589b5258f94", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:92aafedf-24b0-517e-9610-f4db73549b38", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:ec785e84-2072-586d-8224-b75456e896fd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:c5f204a7-a4d4-5791-8d90-5d40df66882a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:bb8bd57f-b3e9-57a3-822a-a32deb1f9ebd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:76547070-ee1a-5f76-8082-c76d5d22629a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:0414aa70-ad21-568a-bd90-93dd404d1608", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:817ecd51-cddf-5c82-b0b5-bd739d33860e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:8406f255-5859-5e21-a1d5-a4bdd1b265c4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:23d9f28e-b703-539e-9a10-41dd05e54657", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:25249473-db89-5eed-bd84-70042c5b0f47", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:d6902194-625f-583a-8a37-24c28ad89f84", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:1fa6cc78-dfdf-5684-bb7f-8c8ec935fc31", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:cf8d5a7f-b7bd-560d-90bc-6627c4b44dc4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:d972fb59-24ef-5b29-b1da-fcd1b6a9a958", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22257 is fixed in version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:7173d473-53b3-5194-b507-6b9df2a6b044", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:c183ea71-7fd8-5acc-8e9b-2aa7ee09e864", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38827 is fixed in version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:06e3c40b-e323-57c6-be2d-f46827c3474e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:980e0938-ef43-5d79-8d17-e9063c9d1ee8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22228 is fixed in version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:532a70d5-874e-5688-918b-e3742f6e7fff", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-aspects. not_affected \u2014 Spring Security 5.7.7 is not affected by CVE-2025-22234. This CVE is a secondary vulnerability introduced by the fix for CVE-2025-22228, which added a password length check to BCrypt that broke timing attack mitigation. The target version (5.7.7) never received the CVE-2025-22228 fix, and therefore does not contain the problematic code that causes CVE-2025-22234. The timing attack mitigation in...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:0265f69d-4da4-581c-b9d0-28fda1f0c564", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-aspects. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.7.7 does not contain that scanner, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:78e636a3-361e-5144-884b-c116aa1a96b6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41248 does not affect version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-aspects. Spring Security 5.7.7 has no generic-type annotation matching of its own: method security looks annotations up through Spring Framework's annotation utilities, so the CVE-2025-41248 code is not present. The equivalent issue in Spring Framework is tracked as CVE-2025-41249.", "justification": "code_not_present" } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:4e2ffb3e-7f48-5762-87cc-39514363265e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:aaa623b8-3834-55eb-87c1-4344a9c0bada", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-aspects. not_affected \u2014 Spring Security 5.7.7 is not affected by CVE-2026-22751 because the vulnerable component (JdbcOneTimeTokenService) does not exist in this version. The One-Time Token (OTT) authentication feature was introduced in Spring Security 6.4.0, and version 5.7.7 predates this feature entirely. Comprehensive searches across the codebase found no JdbcOneTimeTokenService class, no OneTimeToken-related code...", "justification": "code_not_present" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:56f0661a-c609-504b-9825-9a6b58a58077", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:e975d005-a47f-5055-8ef5-916606f63975", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:72641f9c-367f-5ae1-88c7-cafb62a5efd1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-aspects. not_affected \u2014 Spring Security 5.7.7 is not affected by CVE-2026-59277. The vulnerable component, the InetAddressMatchers utility class with matchInternal()/matchExternal() builders for classifying IP addresses as internal or external networks, does not exist in this version. The CVE describes a misclassification vulnerability where 0.0.0.0 and :: are incorrectly treated as external addresses. However, versio...", "justification": "code_not_reachable" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@5.7.7-tuxcare.3" } ] }