{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:fe533f2e-68f6-5603-87ae-2a6bc0f9ff8b", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-config", "purl": "pkg:maven/org.springframework.security/spring-security-config@5.5.8-tuxcare.2", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-config@5.5.8-tuxcare.2", "version": "5.5.8-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-security-config", "purl": "pkg:maven/org.springframework.security/spring-security-config@5.5.8", "type": "library", "group": "org.springframework.security", "version": "5.5.8" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.5.8-tuxcare.2" } ], "bom-ref": "urn:uuid:7d31a96b-1516-59f0-882a-e72592a545d6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.5.8-tuxcare.2" } ], "bom-ref": "urn:uuid:42d73505-b197-5e6c-bc7d-a2e39b70279d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.5.8-tuxcare.2" } ], "bom-ref": "urn:uuid:58b91208-7a61-5886-9983-4735f5f73ee7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.5.8-tuxcare.2" } ], "bom-ref": "urn:uuid:443f41d2-1e0a-5bd7-9fd5-cbc7e764aa16", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.5.8-tuxcare.2" } ], "bom-ref": "urn:uuid:61a2ad5a-5f14-50d9-81c0-909fbeb78fa1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.5.8-tuxcare.2" } ], "bom-ref": "urn:uuid:ec7e893e-f0d7-5cde-9305-f26f15a3f307", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.5.8-tuxcare.2" } ], "bom-ref": "urn:uuid:ffc80487-29d2-5824-b35f-6bfc51d6575a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.5.8-tuxcare.2" } ], "bom-ref": "urn:uuid:2776c8f2-1353-529f-ae65-00c1dcaa6af7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.5.8-tuxcare.2" } ], "bom-ref": "urn:uuid:f207893e-2ef8-5061-ae4d-2da01829033e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.5.8-tuxcare.2" } ], "bom-ref": "urn:uuid:3615c9ee-2eff-5e7e-8ddf-910b6fe0263d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.5.8-tuxcare.2" } ], "bom-ref": "urn:uuid:5176b44a-cba6-56ad-9076-3b178e0a640e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.5.8-tuxcare.2" } ], "bom-ref": "urn:uuid:2415a4fb-02af-5987-8c94-8f504fd60a81", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.5.8-tuxcare.2" } ], "bom-ref": "urn:uuid:7c75fce5-e6db-5d05-b438-f5024811cc84", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.5.8-tuxcare.2" } ], "bom-ref": "urn:uuid:70290446-9c4a-5e7f-9b4f-c4cf54287038", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.5.8-tuxcare.2" } ], "bom-ref": "urn:uuid:0963ffd6-046b-5215-a97f-7a2e44ea4e3d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.5.8-tuxcare.2" } ], "bom-ref": "urn:uuid:f9c7ada4-8d3c-56f5-b997-4d7cfacbe929", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5408 does not affect version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-config. not_affected \u2014 Target is Spring Security 5.5.8 (official upstream release), newer than every CVE-2020-5408 affected range (fix landed in 5.3.2/5.2.4/5.1.10/5.0.16/4.2.16). CVE-2020-5408: Encryptors.queryableText() uses a fixed all-zero (null) IV with AES-CBC, producing deterministic ciphertext that lets an attacker with read access to stored ciphertext derive plaintext via dictionary/frequency attacks. The vendor's fix (the exact input patch, commit db155b3094 \"Clean up Javadoc\") did NOT add a random IV \u2014 doing so would break the deterministic-query feature \u2014 it instead DEPRECATED the queryableText() method with the note \"This encryptor is not secure. Instead, look to your data store for a mechanism to query encrypted data.\" That deprecation is present in the target: Encryptors.java lines 103-107 carry @deprecated + @Deprecated on queryableText(), and commit db155b3094 is confirmed an ancestor of HEAD. Per Rule 3 (trust vendor fix intent), deprecation is the authoritative fix and must not be deemed \"insufficient.\" The fix commit is authored by Eleftheria Stein (upstream Spring, not TuxCare/CloudLinux), and HEAD (5.5.8) is an upstream release by sriesenberg@vmware.com \u2014 so this is the UPSTREAM-fix sub-case of not_affected (justification code_not_present), not already_fixed. Patch 2 (d1909ec, BCryptPasswordEncoder null-check) is unrelated to this CVE. [VC re-run with claude-opus-4-8, prod prompt pin d46bd7a, 2026-09-16; Sonnet run failed the author gate (A2 onboarding-merge overclaim); applied manually after git verification]", "justification": "code_not_present" } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.5.8-tuxcare.2" } ], "bom-ref": "urn:uuid:2dc6b2df-ab89-5ecd-88dc-546310776ced", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.5.8-tuxcare.2" } ], "bom-ref": "urn:uuid:71eba107-dbd0-5a55-b30f-47d42744e345", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.5.8-tuxcare.2" } ], "bom-ref": "urn:uuid:85b1f4bb-3c9d-523b-88b6-e1854fbfda2b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.5.8-tuxcare.2" } ], "bom-ref": "urn:uuid:561a8d3c-f35b-532c-8c83-4d88e1ebba63", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.5.8-tuxcare.2" } ], "bom-ref": "urn:uuid:6ed9415e-284d-5cea-93d2-016b25c02b59", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2023-34034", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.5.8-tuxcare.2" } ], "bom-ref": "urn:uuid:42ea47e7-9144-58a1-a644-4bae50dbaf72", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-34034 affects version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2023-34035", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.5.8-tuxcare.2" } ], "bom-ref": "urn:uuid:ff0f744b-ce9a-5370-8e3f-d7e39044dff8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-34035 affects version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2023-34042", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.5.8-tuxcare.2" } ], "bom-ref": "urn:uuid:f95aeede-8fd3-5776-bf53-30476011135a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34042 does not affect version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-config. not_affected \u2014 Spring Security version 5.5.8 is NOT affected by CVE-2023-34042. The vulnerability involves a symlink file (spring-security.xsd) that creates world-writable permissions when packaged into the JAR. However, this symlink was introduced on 2023-05-19 (commit 1eefd433b6), more than a year AFTER version 5.5.8 was released (2022-05-18). Git history confirms the symlink commit is not in the ancestry o...", "justification": "code_not_present" } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.5.8-tuxcare.2" } ], "bom-ref": "urn:uuid:42540794-45b1-5d1d-89ed-317981c4397a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.5.8-tuxcare.2" } ], "bom-ref": "urn:uuid:ec98df4e-7d33-5bab-acf1-a06b87575c2f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22257 is fixed in version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.5.8-tuxcare.2" } ], "bom-ref": "urn:uuid:98e0e3e2-67dd-50df-b3f1-13d5dd27a5e8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.5.8-tuxcare.2" } ], "bom-ref": "urn:uuid:6695a204-0926-5283-bb92-6cb05fb161f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38827 is fixed in version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.5.8-tuxcare.2" } ], "bom-ref": "urn:uuid:766be6e5-e3e5-5913-b9ee-9ab9addb53ec", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22223 does not affect version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-config. not_affected \u2014 Spring Security 5.5.8 is not affected by CVE-2025-22223. This vulnerability specifically affects Spring Security 6.0+ systems using @EnableMethodSecurity, where the UniqueSecurityAnnotationScanner class fails to resolve generic type parameters correctly. Version 5.5.8 does not have @EnableMethodSecurity or UniqueSecurityAnnotationScanner\u2014it uses the older @EnableGlobalMethodSecurity infrastruct...", "justification": "code_not_present" } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.5.8-tuxcare.2" } ], "bom-ref": "urn:uuid:25dbbd16-8e59-58fe-92c3-868f0348dc15", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22228 is fixed in version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.5.8-tuxcare.2" } ], "bom-ref": "urn:uuid:510ede32-5c0b-5962-9d35-ab1f90d849ab", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-config. not_affected \u2014 Spring Security 5.5.8 (released May 2022) does NOT contain CVE-2025-22234. This CVE is a regression bug introduced by patch 1 (commit c1aa99fdd2, April 2025) which added conditional 72-byte password length enforcement to BCrypt that inadvertently broke timing attack mitigation in DaoAuthenticationProvider. The target repository lacks this conditional check entirely\u2014BCrypt.java contains no passw...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.5.8-tuxcare.2" } ], "bom-ref": "urn:uuid:8639e468-470b-5c11-8c38-e2d0994bbb02", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-config. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.5.8 does not contain that scanner, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.5.8-tuxcare.2" } ], "bom-ref": "urn:uuid:126c096c-b921-5298-9e94-f914a4d69ff3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41248 does not affect version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-config. CVE-2025-41248 affects the annotation lookup used by @EnableMethodSecurity. Spring Security 5.5.8 predates @EnableMethodSecurity, which was added in 5.6, and has no such lookup, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.5.8-tuxcare.2" } ], "bom-ref": "urn:uuid:6c4f4af2-eca8-5e19-b1db-93cbca8545fc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.5.8-tuxcare.2" } ], "bom-ref": "urn:uuid:37f0dd5b-9d29-5ade-a5a3-c549f796fee1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-config. not_affected \u2014 Spring Security 5.5.8-tuxcare.2 does not contain the vulnerable JdbcOneTimeTokenService class or the One-Time Token (OTT) authentication feature. The OTT feature was introduced in later versions (6.5.x+) and does not exist in version 5.5.8. Exhaustive searches confirmed no OTT-related code, classes, or packages are present in the target.", "justification": "code_not_present" } }, { "id": "CVE-2026-22753", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.5.8-tuxcare.2" } ], "bom-ref": "urn:uuid:c331c835-39f6-53f3-aed4-f16e8f8f5f77", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22753 does not affect version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-config. Spring Security version 5.5.8 is not affected by CVE-2026-22753. The vulnerability requires securityMatchers(String) method and PathPatternRequestMatcher.Builder bean support, neither of which exist in version 5.5.8. The securityMatchers method was first introduced in version 5.8.0-RC1 (September 2022), and PathPatternRequestMatcher infrastructure was added in versions 6.5.x+/7.0.x+ (February 2025). Version 5.5.8 (released May 2022) predates both of these features by months to years, making the vulnerable code pattern impossible to manifest.", "justification": "code_not_present" } }, { "id": "CVE-2026-22754", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.5.8-tuxcare.2" } ], "bom-ref": "urn:uuid:044bf571-2d7e-532b-842f-fa3f57a4e5a4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-config. Spring Security 5.5.8 is not affected by CVE-2026-22754. The vulnerability exists in PathPatternRequestMatcher.Builder (Spring Security 7.0.0-7.0.4) where a builder pattern bug prevents the basePath from being configured, causing servlet-path-aware authorization rules to be bypassed. Version 5.5.8 uses a different architecture (MvcRequestMatcher) that correctly handles servlet-path configuration through direct property assignment rather than a builder pattern, and therefore does not contain the vulnerable code path.", "justification": "code_not_present" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.5.8-tuxcare.2" } ], "bom-ref": "urn:uuid:47d9efad-c5ce-5310-a5c5-9d75d9ce8d00", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.5.8-tuxcare.2" } ], "bom-ref": "urn:uuid:42c3e9b4-ce64-5a12-8cad-b6d4d3010127", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.5.8-tuxcare.2" } ], "bom-ref": "urn:uuid:dc16678b-7b5e-5470-806e-3dcda2da885d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 5.5.8-tuxcare.2 of org.springframework.security:spring-security-config. not_affected \u2014 Spring Security 5.5.8 is not affected by CVE-2026-59277. The vulnerable InetAddressMatchers class with matchInternal()/matchExternal() methods does not exist in this version. This class was introduced in Spring Security 7.1.x, multiple major versions after 5.5.8. The target version only contains IpAddressMatcher, which matches specific IP addresses or CIDR ranges but does not perform internal/e...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.5.8-tuxcare.2" } ] }