{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:1c736514-3805-56d3-a032-56b3d6885fed", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-aspects", "purl": "pkg:maven/org.springframework.security/spring-security-aspects@6.0.8-tuxcare.5", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.0.8-tuxcare.5", "version": "6.0.8-tuxcare.5", "pedigree": { "ancestors": [ { "name": "spring-security-aspects", "purl": "pkg:maven/org.springframework.security/spring-security-aspects@6.0.8", "type": "library", "group": "org.springframework.security", "version": "6.0.8" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:e0fe8757-c8e5-51a7-a4f7-bc8354d286ba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:1e5bdc6c-f48a-56cb-91fc-25db19e1a91b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:a000fcba-71e5-564f-93ac-8f780e3f2474", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:28d9d92b-000d-5600-ab6a-f55803171f9c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:e4ab9c0d-c0ce-5fb3-b9b4-314771ae5d96", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:716d2e48-8d1e-5813-b3a6-6b0f05ad634e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:c90c691c-a084-51e0-b673-39976529f453", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:44d242ad-707b-5f0a-9113-568bfaab3d42", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:04c6b2be-7c9f-57d2-89cc-a9f6158b4ee5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:aed3e612-a3c2-594f-86ad-c7c2ebc57f5c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:7fbb930d-2f2b-543b-8f6c-9f55d31ffd61", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:ca374af2-45b8-531b-bc88-955da223f5ff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:a452c194-4c77-5b75-b5e1-173c5523d83c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:7cc8b90f-64f7-5b76-ad27-6580a5d352b2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:10fd77fc-da5e-5946-ac1e-e77101960759", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:c1888ce6-c78e-5ee8-aa50-f22c00ba6ffc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:5d2d5926-1989-548c-82bc-72557326871e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:dc6023c2-39ae-5a20-9e6a-0fa39d6b5293", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:1867643d-b50e-54e5-b1b8-87f7c37ee42b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:2db3589c-bf3a-594c-856b-46cb1c475e0b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:89b4e8b4-a400-52cb-828f-6420084c71c9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:23c5b3e3-fb8b-57b8-b55a-5b8c7e928af4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:920cef9c-af84-58ae-844e-839e19cb4963", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22257 is fixed in version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:6228d154-d3c5-5378-a22c-bfd2d7330ff5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:9f9d8ee2-54d9-514c-8d6e-235fb455414d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38827 is fixed in version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:7d2d9cc7-ca4a-56ef-9da4-9c96273b1e4a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:b604e0a1-0060-5c31-bea6-929aefd1d7fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22228 is fixed in version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:fbbb5920-a20c-5df6-bf6d-113d8dbd0fde", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22234 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:240ba8b6-2ec2-5559-9885-5d57da497d24", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-aspects. Spring Security 6.0.8 contains a copy of the pre-fix method lookup from a TuxCare backport, but it is only used together with Spring's own annotation lookup, which finds annotations on private methods, so the CVE-2025-41232 authorization bypass cannot occur.", "justification": "code_not_reachable" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:7e87a4ad-7892-5bb5-b639-17d0670e3cc6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41248 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:331e8de6-2b4f-5ed1-90b9-227ad878292e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:ad811d33-f269-5d76-989a-82925207bbef", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-aspects. not_affected \u2014 Spring Security version 6.0.8 is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService and the entire one-time token authentication feature) does not exist in this version. The one-time token login feature was introduced in Spring Security 6.4.0-RC1, released after version 6.0.8. Exhaustive searches across the codebase confirmed no OneTimeToken classes, JdbcOneTimeTo...", "justification": "code_not_present" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:cc961b04-1eb0-5c5f-bc6e-60290e0963d3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:21ff2d00-b894-5606-9b1d-976ef461698d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:c1985503-2e0a-5eca-9286-421e5ecd2eeb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-aspects. not_affected \u2014 Spring Security 6.0.8 is not affected by CVE-2026-59277. The vulnerability exists in the `InetAddressMatchers` utility class with its `matchInternal()` and `matchExternal()` methods, which do not exist in version 6.0.8. This class was introduced in a later version of Spring Security (after 6.5.11). Without this utility, there is no mechanism to classify IP addresses as internal/external, and th...", "justification": "code_not_reachable" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.0.8-tuxcare.5" } ] }