{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8b0e60e3-3407-5f12-9080-9e69c8f56674", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-aspects", "purl": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.20", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.20", "version": "6.3.10-tuxcare.20", "pedigree": { "ancestors": [ { "name": "spring-security-aspects", "purl": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10", "type": "library", "group": "org.springframework.security", "version": "6.3.10" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:2108e256-6386-5fac-a332-8853410bade1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:a90382a8-c406-51ed-87e5-2c5ddd15ceec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:baa45597-ac5a-5a55-a526-923a898aa335", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:93e5f9c6-6aed-5de1-88e0-fd57a37889bf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:74d40657-32ae-5a79-9e07-5e51e1afbe74", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:1905fbb9-96ed-5add-87c6-3a91c288c98a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:d7879625-904c-5155-b1b6-71e8c1dd8b09", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:10e4683e-4440-5bf1-bf27-f3a3967629a2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:2eff0feb-f72a-5465-8bb8-166aaba211e9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:4d6b1c3a-df12-55d3-9a15-16e977335006", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:ca07bdb5-644b-557b-83f8-46e2831b3953", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:6ee82a0d-a39e-5bfa-a498-9918f09236fc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1258 does not affect version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-aspects. not_affected \u2014 The target Spring Security 6.3.10-tuxcare.7 is not affected by CVE-2018-1258. The vulnerability existed in Spring Framework versions 5.0.5/5.0.6 and was fixed in Spring Framework 5.0.7 (June 2018). The target depends on Spring Framework 6.1.20-tuxcare.5, which is approximately 6 years newer than the fixed version and contains all security fixes from 5.0.7 onwards.", "justification": "requires_dependency" } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:cb895a11-e903-5eb7-a04f-a1d61b17454d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:318f70f0-7525-52b5-a1cc-a0c221a1fb3e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:0e7b3583-ff40-5e27-95b0-b2dcf609a5f5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:ecd400bb-65f3-52e3-9cc5-56ff0cc04536", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:3196b65f-d43b-55aa-91d8-0359d62d8780", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:42462ff5-e18c-5a83-8fa5-204c1caee46e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:f99d6a3c-4383-516e-9a24-be55941ee995", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:143fbc96-02fa-5d4a-acce-55c208b9c64c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:7666d3b0-3dba-51c6-85dd-4282b244c4e9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:a4a00600-e7ac-5224-a166-e4ff070c7e5c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:798e85ea-a57f-526b-8c98-efcef11c13a0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:92ffb0e9-cd68-5899-8054-f7613ae04049", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22257 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:d995385f-fad7-5d9d-9e90-1cfc22f635b4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:fd68ac4d-e0b9-5aee-a535-f4af2adf92fd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38827 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:a4cffcab-24d1-5445-988e-287fe92fb04c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:94bc1493-2fca-5ae2-afbf-ff13de1bdd9f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22228 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:1eebc178-4007-5604-9653-16ca78731fa8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-aspects. not_affected \u2014 The target repository (spring-security 6.3.10-tuxcare.21) is NOT AFFECTED by CVE-2025-22234. The vulnerability was fixed by upstream Spring Security in commit c1aa99fdd2113a232986e9c3a44673ae752de840 (dated 2025-04-17) before TuxCare onboarded version 6.3.10. The fix conditionalizes the 72-byte password length check to only apply when encoding new passwords (!for_check), not during authenticati...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:40a8cd56-62a0-512d-93da-aee316c17780", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-aspects. Spring Security 6.3.10 contains a copy of the pre-fix method lookup from a TuxCare backport, but it is only used together with Spring's own annotation lookup, which finds annotations on private methods, so the CVE-2025-41232 authorization bypass cannot occur.", "justification": "code_not_reachable" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:187df333-f317-57e2-8d02-ec177f53e097", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41248 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:990dc925-e499-5de4-a980-fb52a7586d2f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:aef95359-c42f-5a04-8f6e-6ad314d69a68", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-aspects. not_affected \u2014 Spring Security 6.3.10 is not affected by CVE-2026-22751. The vulnerable component JdbcOneTimeTokenService was introduced in version 6.4.0, which postdates this target version. The one-time token authentication feature does not exist in 6.3.10.", "justification": "code_not_present" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:1d0f0c9f-5371-5fbc-b606-6dd642f4a8e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:4d35e3e1-406f-5bea-9ddb-9a5dbd2fe492", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:9948f1fe-6737-5334-8c66-25689a98311d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-aspects. not_affected \u2014 Spring Security 6.3.10 does not contain the InetAddressMatchers class or its matchInternal()/matchExternal() methods that are affected by CVE-2026-59277. The vulnerability concerns incorrect classification of \"any local\" addresses (0.0.0.0 and ::) as external rather than internal. This functionality was introduced in a later version of Spring Security (patches dated June/July 2026, after the 6....", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.20" } ] }