{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7f633e29-e5ec-5f97-b4b4-1fa4fe6c946d", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-aspects", "purl": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.6", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.6", "version": "6.2.8-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-security-aspects", "purl": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8", "type": "library", "group": "org.springframework.security", "version": "6.2.8" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:bd47c63f-2b0c-5a8c-b4b2-c1b378ad28b4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:c828a3a7-10dd-5404-b97a-62de6777c784", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:ed6735d3-230a-5100-b3af-dcda6d64f32e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:d22ba1c1-ffd6-5c67-aaae-10562a1ef44d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:48075acf-a592-563b-86b8-d3c0a59b3fa8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:e5c6695b-7bf4-5fa7-acc0-b7a1e3d5116a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:8630d64f-002d-5db9-be3a-ce89e28770cb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:57c72dde-5133-550b-9372-e6dc184e7131", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:400fc86e-e82f-5092-99ca-a787f0bbddd9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:d736f216-9e9e-5760-9704-46b3f903c153", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:964570c4-7dc7-53bc-9d2f-11605906d127", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:ea8ce693-9b74-5abd-b688-ec3adada8272", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:79797b2a-69db-52a3-9eab-dd13ac947564", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:3226397e-67cf-5017-bdc6-ac8afdc9bb2a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:60d80fa7-db8b-5957-a9b0-06cc2c047b94", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:3728d05e-dbba-54d1-8f05-aa3e2bfdfd01", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:ddd9e727-7283-5f4a-84f7-5856781f4e19", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:25faa4b8-0466-50a5-8b0b-171fa82c32b0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:84641121-1182-591e-9db6-e2f4227b42c5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:c99bb84f-8316-5fed-b77f-a6661ffe5dba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:332839f4-3a9e-5bbc-924b-077e30eb9340", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:019667f6-0bf5-54f6-a1db-404334bfcaa1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:00f05ef1-c5df-51da-9672-b51713655c09", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22257 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:5e7ec1d2-6fe1-54c7-9796-65fd43c7f275", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:4501e7f1-2cf4-5973-9697-0fe4b9f44d76", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38827 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:49cc9880-a7e6-55e3-9105-696176c1a782", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:74108d73-6d6c-5728-8dd7-17b3dabdd857", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22228 is fixed in version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:df664c8e-41a4-535e-9a45-a9cbbfcdaa5e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22234 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:3ee58bcd-8f55-5af5-92fc-aeeaf896db6f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-aspects. Spring Security 6.2.8 contains a copy of the pre-fix method lookup from a TuxCare backport, but it is only used together with Spring's own annotation lookup, which finds annotations on private methods, so the CVE-2025-41232 authorization bypass cannot occur.", "justification": "code_not_reachable" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:c2e3e06c-6a00-5a08-95ad-bee8f23f5313", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41248 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:f59fcf5a-a84b-54cb-9ba1-f919cd8a22c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:da42ce99-4488-56d1-a607-00d4edf2797c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-aspects. not_affected \u2014 Spring Security 6.2.8 is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService) and the entire OneTimeToken authentication feature were introduced in Spring Security 6.4.0, which is a later version than the target 6.2.8-tuxcare.6. The feature does not exist in this codebase, therefore the TOCTOU race condition cannot occur.", "justification": "code_not_present" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:6e9e205f-c785-5a43-a0a2-33fa61ad793c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:9431202d-0927-5707-9095-052f47d8ea04", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:ac6a9a94-b542-5537-9fe3-d15c7dc475a2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-aspects. not_affected \u2014 Spring Security 6.2.8-tuxcare.6 is not affected by CVE-2026-59277. The vulnerable component (InetAddressMatchers class with matchInternal()/matchExternal() builders) does not exist in this version. The CVE affects a utility class that classifies IP addresses as internal vs external for access control purposes, but this functionality is not present in 6.2.8. The existing IpAddressMatcher class s...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.6" } ] }