{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c4f28c69-4cc2-5d7e-a7a8-7bd1ac9ced5e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-cas", "purl": "pkg:maven/org.springframework.security/spring-security-cas@3.2.8.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-cas@3.2.8.RELEASE-tuxcare.1", "version": "3.2.8.RELEASE-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-security-cas", "purl": "pkg:maven/org.springframework.security/spring-security-cas@3.2.8.RELEASE", "type": "library", "group": "org.springframework.security", "version": "3.2.8.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c50e33b9-797d-5d42-b613-e2ba53798f96", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:dd9e7beb-4c85-5ed5-a583-4c47b0010522", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:de7c3784-25c5-578d-877f-7665bba2c4d6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:439d64ff-9fe5-5ba2-afd3-4a700e2960ae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d22b35e5-0db8-5f25-86b3-4acd14444d81", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2cb9c14a-1bca-59c6-b21b-32499926b9ae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:fcf4785f-2174-5bfb-a85a-d704a9e5296a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f81c8d7b-83e9-5633-8b94-3ad66d1bd64e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a1259607-9db0-5581-8f9a-9e7786199deb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ea1431ea-301c-56ae-84c9-e5a7c8ffdd82", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c247f3e5-d945-55ac-85ab-1bbcca1a626b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:68e7806e-deb5-59b1-bd0f-355e861d426b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:580e1297-bed0-5f6c-9b18-47b4ede11dad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-11272 is fixed in version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b633b4db-5727-561c-9a95-d6d83c765d22", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:39e1a6cf-46da-58be-931d-da6e3c628ebd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:599a902c-e7a6-537e-899b-b63e0721151f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2021-22112", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d968b336-884f-5233-a630-321d5953325b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22112 is fixed in version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2a6a34c3-8e31-5a07-8610-861ab87bd715", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:13dec19f-c631-5dbd-a091-f45b0ea47f9b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ab260b84-e21d-5f75-a562-203a406fd96b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22978 is fixed in version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2e5707b6-fe6e-5e68-b56d-4d2e290b5345", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4bf06c7f-c7ac-51fa-967d-836940789216", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ab3c28a0-066e-570f-8e59-911a22c2541e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:841bf465-133a-5ea0-befa-9026be47f5be", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22257 is fixed in version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5eb8b6d5-e726-57d4-9553-4359c126e7f8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2024-38821", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a0cde381-6a8b-5a27-a7e8-e7435152cff4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38821 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:714f79d1-486f-572c-9e2a-b12f36187641", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38827 is fixed in version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d9dfe39c-1c22-5451-b226-5cb3977270b2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22223 does not affect version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas. not_affected \u2014 Spring Security 3.2.8.RELEASE is not affected by CVE-2025-22223. The vulnerability targets the modern method security architecture (`@EnableMethodSecurity` + `UniqueSecurityAnnotationScanner`) introduced in Spring Security 5.6+. Spring Security 3.2.8 uses a fundamentally different architecture (`@EnableGlobalMethodSecurity` + `PrePostAnnotationSecurityMetadataSource`) and lacks both the vulnera...", "justification": "code_not_present" } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8b512235-00b8-5307-ae76-d38d0e472411", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas. not_affected \u2014 CVE-2025-22234 is not present in Spring Security 3.2.8.RELEASE. This CVE is a secondary vulnerability that only manifests when CVE-2025-22228 is present. CVE-2025-22228 introduced a 72-byte password length check in BCrypt that inadvertently broke timing attack mitigation in DaoAuthenticationProvider. The target version does not have CVE-2025-22228 applied (no 72-byte limit exists in BCrypt.java...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4f19917d-f15b-5570-a762-0dc8c6dabc8c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 3.2.8.RELEASE does not contain that scanner, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7eee73de-ec8a-5d53-9c1b-3725a4154b14", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41248 does not affect version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas. CVE-2025-41248 affects the annotation lookup used by @EnableMethodSecurity. Spring Security 3.2.8.RELEASE predates @EnableMethodSecurity, which was added in 5.6, and has no such lookup, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-22732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:29c4da4a-b9f6-5d24-975f-91655a167020", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22732 is fixed in version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1fbc31c6-94bc-5579-8628-7da4786070b9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2026-22747", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:278bde33-2111-5374-9115-77a8c13b2506", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22747 is fixed in version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:237a10ce-b6c8-533c-9ee1-e8049a33b163", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas. not_affected \u2014 Spring Security 3.2.8.RELEASE is not affected by CVE-2026-22751. The vulnerable JdbcOneTimeTokenService class and the entire one-time token authentication feature do not exist in this version. The one-time token (OTT) authentication feature was introduced in Spring Security 6.x (circa 2021-2022), while version 3.2.8.RELEASE dates from 2015. The target repository contains no code that processes ...", "justification": "code_not_present" } }, { "id": "CVE-2026-22754", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:075c0f1d-0c8e-52d5-92b2-7442c75541d3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas. Spring Security 3.2.8.RELEASE is not affected by CVE-2026-22754. The vulnerability exists in the servlet-path attribute feature for intercept-url elements, which was introduced in Spring Security 7.0.0. Version 3.2.8 uses a completely different architecture (AntPathRequestMatcher/RegexRequestMatcher) that reads servlet paths from HTTP requests rather than configuration. The servlet-path attribute does not exist in the 3.2.8 XSD schema, and the vulnerable classes (PathPatternRequestMatcherFactoryBean, HttpSecurityConfiguration with PathPatternRequestMatcher.Builder) do not exist in this version.", "justification": "code_not_present" } }, { "id": "CVE-2026-41706", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:bf2a73a9-a318-59c7-99db-26800b5899c7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41706 does not affect version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas. not_affected \u2014 Spring Security version 3.2.8.RELEASE is not affected by CVE-2026-41706. The vulnerable classes CookieRequestCache and CookieServerRequestCache do not exist in this version. Version 3.2.8 only implements session-based request caching via HttpSessionRequestCache, which stores saved requests in HTTP sessions, not cookies. The vulnerability specifically requires applications to use CookieRequestCa...", "justification": "code_not_present" } }, { "id": "CVE-2026-47838", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5cc07408-b723-59f1-bffc-8acd660eceec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47838 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2026-47841", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a9d0e857-22e3-5fc0-9def-27ac041624ba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47841 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d4dc56b2-3418-5bb3-ac42-61194958a546", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59276 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:cfc2ed1d-9e57-5c0f-8bf7-54622a1783d6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas. not_affected \u2014 Spring Security 3.2.8.RELEASE is NOT AFFECTED by CVE-2026-59277. The vulnerability requires the InetAddressMatchers utility class with matchInternal()/matchExternal() methods for classifying IP addresses as internal vs external. This feature does not exist in version 3.2.8.RELEASE. The target only has IpAddressMatcher for basic subnet matching, with no internal/external classification capabilit...", "justification": "code_not_reachable" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@3.2.8.RELEASE-tuxcare.1" } ] }