{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d5e09d01-e2e3-5902-855b-2bac3c8608ec", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-data", "purl": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.2", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.2", "version": "5.1.6.RELEASE-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-security-data", "purl": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE", "type": "library", "group": "org.springframework.security", "version": "5.1.6.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6820ca09-de3e-59b4-b4ec-5752b60a2492", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3bb1f7a5-7c1f-5192-82e8-652b5d702e39", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:229c88bb-5942-5f80-80d2-fc398e649f53", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8073c7fc-3fb4-5d3a-a780-73d06b248554", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5c529337-42e5-5680-b287-5f86e3a1821c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:fcf5d289-fcee-5d3e-8012-23903effd1a0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1381dc2b-bd28-547e-aa88-d4ed45ca5044", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:98fac6cc-f595-5414-9033-d57826b15e64", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:068a87bf-c717-5c49-8438-94902cd6b2ef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8a537668-30a4-578a-9f94-05360ecdb067", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6d34be4c-a9a9-5bc2-a31e-e4a6fc61dd0a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3e4045be-18dc-5f5c-b6ee-a66afabf7381", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:95fb4837-e8ab-54a2-b0cc-1918c02de4fc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7d15347f-d0d4-540d-bb8d-df8a6220bb68", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:69ff2f42-4678-5c84-8fc7-0c257e5be3dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c1cac329-8103-5370-ab5a-1e00dce1a8ab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:91d0d8ec-4376-571e-9ab6-11d7460b0e56", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:801e44b9-a7d4-5f98-95f1-38304ca0ffd7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:53e97097-5790-541d-9025-42b7be1b65f4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22978 is fixed in version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:73a62a08-692f-5dd7-b409-89ce3b525640", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0a2ddb6f-789e-5b47-bb6b-e72f73fd5aab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f6ee1041-76e8-5638-aed9-6849f222ac02", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:27200008-8025-564a-ac01-332b4143acf1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22257 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e4da4913-fc54-50e0-ae5c-7ee734739bbe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f9ecd7cc-f048-5059-a893-99766cf1940c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38827 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9cf37b0f-9055-51e6-8728-4349bbde4046", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22223 does not affect version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-data. not_affected \u2014 Spring Security 5.1.6.RELEASE does not contain the vulnerable code. CVE-2025-22223 specifically affects applications using @EnableMethodSecurity (introduced in Spring Security 5.6+), which resolves method security annotations via UniqueSecurityAnnotationScanner. Version 5.1.6 uses the older @EnableGlobalMethodSecurity API with PrePostAnnotationSecurityMetadataSource, a completely different impl...", "justification": "code_not_present" } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:13bf2faf-8ec5-5ea0-840e-89da5580b45e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-data. not_affected \u2014 The target spring-security 5.1.6.RELEASE is NOT affected by CVE-2025-22234. This CVE addresses a timing attack vulnerability that was inadvertently introduced by the CVE-2025-22228 fix. However, 5.1.6.RELEASE never received the CVE-2025-22228 backport, so the vulnerable code pattern (unconditional 72-byte password length check in BCrypt.hashpw that breaks DaoAuthenticationProvider's timing atta...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:df0f2118-ce93-54b4-bf09-766b3962f8b5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-data. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.1.6.RELEASE does not contain that scanner, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b2657941-57c0-5eec-822b-5c6518c39f3f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41248 does not affect version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-data. CVE-2025-41248 affects the annotation lookup used by @EnableMethodSecurity. Spring Security 5.1.6.RELEASE predates @EnableMethodSecurity, which was added in 5.6, and has no such lookup, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b7633e1d-1443-5d00-97ae-7ad72b19c263", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7a3192c0-87ee-5abc-b804-e0654a55314c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-data. not_affected \u2014 Spring Security 5.1.6.RELEASE-tuxcare.2 is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService and the entire One-Time Token authentication feature) was introduced in Spring Security 6.4.0-M4 (July 2024), long after the 5.1.6 release. The target version does not contain the vulnerable code, cannot process one-time token authentication requests, and lacks the authen...", "justification": "code_not_present" } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:62e8c761-9b5b-5665-8424-8d57a0238874", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1762feb3-6277-5d32-b57a-fcc515af3aa3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-data. not_affected \u2014 Spring Security 5.1.6.RELEASE-tuxcare.2 is not affected by CVE-2026-59277. The vulnerable component InetAddressMatchers (with matchInternal() and matchExternal() methods) does not exist in this version. The class was introduced in later versions of Spring Security. Version 5.1.6 only contains IpAddressMatcher, a CIDR-based subnet matcher without internal/external IP classification capabilities,...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.2" } ] }