{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7d0b92c9-5030-5c6b-9a2b-6a125bf0c220", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-bom", "purl": "pkg:maven/org.springframework.security/spring-security-bom@5.8.15-tuxcare.3", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-bom@5.8.15-tuxcare.3", "version": "5.8.15-tuxcare.3", "pedigree": { "ancestors": [ { "name": "spring-security-bom", "purl": "pkg:maven/org.springframework.security/spring-security-bom@5.8.15", "type": "library", "group": "org.springframework.security", "version": "5.8.15" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2007-1651", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-bom@5.8.15-tuxcare.3" } ], "bom-ref": "urn:uuid:298200b2-837e-50fa-9175-5c7f878a1e94", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2007-1651 does not affect version 5.8.15-tuxcare.3 of org.springframework.security:spring-security-bom. not_affected \u2014 Target = Spring Security 5.8.15.tuxcare.1. The OpenID module and OpenID4JavaConsumer.java exist, so the vulnerable component is present in this project. However, the upstream fix for the CVE-2007-1651 / commit f5468087 issue is already applied: OpenID4JavaConsumer.endConsumption() clears the cached DiscoveryInformation from the HTTP session at line 136 (`request.getSession().removeAttribute(DISCOVERY_INFO_KEY);`), immediately after reading it (line 129) and before it is used for verification (line 147). This removal is exactly the one-line change the vendor patch introduced, and git history confirms upstream commit f5468087c2 (Luke Taylor, 2010) is the commit that added this line and is present in the target tree. Because the cached authentication artifact is deleted after a single use, a later replayed/forged callback finds no cached discovery info: the null-check at lines 130-133 then throws \"DiscoveryInformation is not available. Possible causes are lost session or replay attack\", so a logged-out user's session cannot be restored via a cached token. The pre-fix vulnerable pattern (read cached discovery info WITHOUT removing it) is not present in HEAD. The fix is upstream-authored (springsource.com domain), not a TuxCare backport, so the verdict is not_affected with justification code_not_present. The TuxCare work at HEAD (merge of JAVAELSCVE-1165) only updates oauth2/saml2 .gradle build files and is unrelated to OpenID. [VC re-run with claude-opus-4-8, prod prompt pin d46bd7a, 2026-09-16; Sonnet run failed the author gate (A2 onboarding-merge overclaim); applied manually after git verification]", "justification": "code_not_present" } }, { "id": "CVE-2007-1652", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-bom@5.8.15-tuxcare.3" } ], "bom-ref": "urn:uuid:b84c4c79-6647-554e-b737-138288de0607", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2007-1652 is a false positive for org.springframework.security:spring-security-bom 5.8.15-tuxcare.3. CVE-2007-1652 is a vulnerability in JanRain's myOpenID hosted service, on the OpenID\nProvider side. It does not apply to Spring Security in any version.\n\nNo affected software product is on record. The CVE record carries vendor \"n/a\", product\n\"n/a\" and version \"n/a\"; NVD lists a single unversioned CPE, cpe:2.3:a:openid:openid:*,\nwith no version bounds; the GitHub advisory GHSA-3x88-xvgr-m6fg is unreviewed and lists\nno affected package in any ecosystem; OSV has no entry for any spring-security artifact\n(control: the same query returns 5 entries for spring-security-config and 31 for\nspring-security-core); and spring.io publishes no advisory for this CVE. Every one of the\neight references points to JanRain's myOpenID security-fix announcement of March 2007 or\nto the openid.net security mailing list threads of the same month, where the reporter\nstates the problem had to be fixed on the myOpenID server.\n\nThe reported mechanism is Provider-side by construction. A crafted web page uses a cached\nauthentication token and an existing Provider session to forcibly log a user into an\nOpenID-enabled site, release the user's personal information to it, and silently add that\nsite to the user's trusted-sites list. A trusted-sites auto-approval list exists only at\nan OpenID Provider; a relying party has no such list and no auto-approval step at which\nthe flaw could occur.\n\nThe openid module of Spring Security implements only the relying-party (consumer) role.\nOpenIDAuthenticationFilter drives the two-leg consumer flow and OpenID4JavaConsumer wraps\nopenid4java's ConsumerManager. The only openid4java packages referenced in the tree are\nconsumer, discovery, message and association - there is no use of org.openid4java.server,\nno ServerManager, no OpenID Provider implementation, and no trusted-sites or auto-approval\nhandling of any kind. No openid4java sources are vendored into the tree.\n\nNor could this library have been affected when the issue was disclosed: the CVE was\npublished on 24 March 2007, while the earliest OpenID code in the project dates from\n20 April 2007 and only reached the shipped openid module in January 2008.\n\nResolved consistently with spring-security 5.6.10 (VPV 9976), 5.7.11 (43741),\n5.7.12 (12031), 5.7.14 (40534) and 5.8.16 (330), all closed as false_positive." } }, { "id": "CVE-2021-22112", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-bom@5.8.15-tuxcare.3" } ], "bom-ref": "urn:uuid:d17cff75-c721-58c2-97ec-d81493903823", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22112 affects version 5.8.15-tuxcare.3 of org.springframework.security:spring-security-bom." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-bom@5.8.15-tuxcare.3" } ] }