{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:89225b1a-8883-5bb6-a3c2-67ef4411dc89", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-aspects", "purl": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.21", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.21", "version": "6.3.10-tuxcare.21", "pedigree": { "ancestors": [ { "name": "spring-security-aspects", "purl": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10", "type": "library", "group": "org.springframework.security", "version": "6.3.10" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:62cb4b79-90cc-58ea-9809-a23c57bcf492", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:b3d0df5f-b32a-573d-8188-545f75a9eaa4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:13350ef6-2da7-56da-be8a-daede022f587", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:6810772a-e7f4-50d6-963b-a5d174cae3a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:c80a4bc3-663e-529a-bc1c-dacb53905140", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:0e1d7271-1730-511f-a39b-a8023679eec5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:ea522421-0e34-56a4-a56b-a7808759c673", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:100d5145-adfd-5110-ab5a-c44faa46dcf3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:657b2342-ca20-57b0-8a51-1629e7a780cc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:b938b4c5-0e01-5c00-9f53-f765283a9918", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:3b6e9e60-d92a-59cd-a7c6-80605b5aa770", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:a9185655-6745-50a4-a895-bc19ef37125a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1258 does not affect version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-aspects. not_affected \u2014 The target Spring Security 6.3.10-tuxcare.7 is not affected by CVE-2018-1258. The vulnerability existed in Spring Framework versions 5.0.5/5.0.6 and was fixed in Spring Framework 5.0.7 (June 2018). The target depends on Spring Framework 6.1.20-tuxcare.5, which is approximately 6 years newer than the fixed version and contains all security fixes from 5.0.7 onwards.", "justification": "requires_dependency" } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:a57579ef-1258-5eb4-83c6-5c9073aa2f8a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:af949182-5960-59c2-ac36-2f01c5c332c6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:96a8c2d6-2746-5a47-95cc-10fbbec7d918", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:c1126fbf-868a-50aa-b5b4-91339c76cba7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:db6f6357-c1da-52b6-9ce4-0e9861ac45b6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:13f1cba1-8843-5715-bb4e-73e730778c23", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:80eded6c-d399-5250-8b7c-03cf7fdd77bf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:0f877e9b-056f-54b6-9171-c1be1cce9b5c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:4350fd89-3e29-57f9-ad14-858c0d232604", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:419bf535-ac0d-5db6-a5c4-73205b2129e7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:22912de6-42a4-5391-ab32-bce3450535b5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:07206b5f-dcc0-5503-b32e-d3fe630c81ef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22257 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:58ac69db-2317-5e38-8ea4-3b8536603887", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:16c7c29c-2510-5c70-9099-efb31b6da329", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38827 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:5225bf58-7620-54b9-beb9-bcddafa03ad6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:73e94be1-a185-58ac-bff5-e7a71980303b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22228 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:40d0adfc-2abc-5dac-8d0d-0237db9b8f11", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-aspects. not_affected \u2014 The target repository (spring-security 6.3.10-tuxcare.21) is NOT AFFECTED by CVE-2025-22234. The vulnerability was fixed by upstream Spring Security in commit c1aa99fdd2113a232986e9c3a44673ae752de840 (dated 2025-04-17) before TuxCare onboarded version 6.3.10. The fix conditionalizes the 72-byte password length check to only apply when encoding new passwords (!for_check), not during authenticati...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:0e7ee4d2-cc1c-5b77-9758-07d69ec8cafb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-aspects. Spring Security 6.3.10 contains a copy of the pre-fix method lookup from a TuxCare backport, but it is only used together with Spring's own annotation lookup, which finds annotations on private methods, so the CVE-2025-41232 authorization bypass cannot occur.", "justification": "code_not_reachable" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:a97e6a41-c658-5a53-8631-aee7a1a8752f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41248 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:b55d4cff-b68f-5db0-8e95-092e34f38fe4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:f0498200-4905-5299-9b45-c9a1e4c2dd1d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-aspects. not_affected \u2014 Spring Security 6.3.10 is not affected by CVE-2026-22751. The vulnerable component JdbcOneTimeTokenService was introduced in version 6.4.0, which postdates this target version. The one-time token authentication feature does not exist in 6.3.10.", "justification": "code_not_present" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:b1b0d613-4487-5c08-aa98-2ee07b789b32", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:57f26e72-0791-5e06-9b89-1478e6305e7b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:94a5314d-7cfc-5200-a2dd-45a49292e3d2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-aspects. not_affected \u2014 Spring Security 6.3.10 does not contain the InetAddressMatchers class or its matchInternal()/matchExternal() methods that are affected by CVE-2026-59277. The vulnerability concerns incorrect classification of \"any local\" addresses (0.0.0.0 and ::) as external rather than internal. This functionality was introduced in a later version of Spring Security (patches dated June/July 2026, after the 6....", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.10-tuxcare.21" } ] }