{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:b95aae10-cba8-5891-a767-a5f77c2f107c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-data", "purl": "pkg:maven/org.springframework.security/spring-security-data@5.7.7-tuxcare.1", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-data@5.7.7-tuxcare.1", "version": "5.7.7-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-security-data", "purl": "pkg:maven/org.springframework.security/spring-security-data@5.7.7", "type": "library", "group": "org.springframework.security", "version": "5.7.7" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:165a89dd-3d91-5097-92b0-fbc18a490208", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:e95fcfe2-aa3c-5d08-8574-780368fd90c6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:822460bd-090f-5fbe-9b88-f6647f5533d3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:9051013d-8831-5139-b088-6cd4ac7eb5c3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:df6cdf9b-8f6c-5ae7-a7e8-8f0fdb4ab7e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:a170a4de-f839-5f73-b2a5-a135bee8e032", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:67fa8156-bf74-5096-901a-bcba0b122418", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:ef52e2a3-11b4-5b41-b5c6-c04955a094a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:d30e0834-331e-578b-9112-1c8d2df67e7c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:111dc5f6-0fbd-5c4f-8e64-40e5d1a51757", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:f03e943f-aa66-56d7-8774-748cc58ac63b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:84e3897f-f549-5d95-bd9b-b02443196add", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:18ff4570-c703-51d1-91f7-c4cb71a97b36", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:b1a126a2-e0db-5e30-a8d9-b2c586deeb27", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:eb291e17-3215-5c2d-b467-600c4f3c26b9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:38a5e0b6-4d76-558c-a99d-83cf2d9ff439", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:acfa717f-1e4b-570f-b1db-8dd9ddb91cfd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:2a3b5d4e-d9e9-5295-bbe7-2f8b90e937e6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:db79ff24-df48-50f8-be41-d8c843e347f3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:61e83eef-0b72-5c60-a7f3-186c7b232f79", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:28147f41-3501-5152-ae33-615e98cec5ef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:81dbe787-2f67-55e8-bf27-2e047618e06a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:873c3025-2056-5e81-abbb-941baafc449f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22257 is fixed in version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:e9d3155c-2887-5b41-9b4e-df018bc186b1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:46610756-f4cd-56e2-9008-be5a93e8f2bb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38827 is fixed in version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:f32b158d-17a3-5bc1-a6b9-055012526c67", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:1857fbf6-ad13-518b-8f5c-32d1efb4e986", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22228 is fixed in version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:f0713999-6087-53c1-9508-8f6e3a39f5aa", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-data. not_affected \u2014 Spring Security 5.7.7 is not affected by CVE-2025-22234. This CVE is a secondary vulnerability introduced by the fix for CVE-2025-22228, which added a password length check to BCrypt that broke timing attack mitigation. The target version (5.7.7) never received the CVE-2025-22228 fix, and therefore does not contain the problematic code that causes CVE-2025-22234. The timing attack mitigation in...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:474b4f86-4641-5b24-bc37-abd0154d89e4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-data. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.7.7 does not contain that scanner, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:297a2238-ca92-5410-a61e-75f986195cf4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41248 does not affect version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-data. Spring Security 5.7.7 has no generic-type annotation matching of its own: method security looks annotations up through Spring Framework's annotation utilities, so the CVE-2025-41248 code is not present. The equivalent issue in Spring Framework is tracked as CVE-2025-41249.", "justification": "code_not_present" } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:b63bfae5-f014-503a-8240-17ffc8af06a3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:90681810-6774-5da7-9907-6c45b85e231c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-data. not_affected \u2014 Spring Security 5.7.7 is not affected by CVE-2026-22751 because the vulnerable component (JdbcOneTimeTokenService) does not exist in this version. The One-Time Token (OTT) authentication feature was introduced in Spring Security 6.4.0, and version 5.7.7 predates this feature entirely. Comprehensive searches across the codebase found no JdbcOneTimeTokenService class, no OneTimeToken-related code...", "justification": "code_not_present" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:c8a55cee-d5ba-50c9-97e7-74360372c7b8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47842 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-data, and is fixed in 5.7.7-tuxcare.2." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:3df78f76-d83b-592c-ba01-b7f585f8d8ff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59276 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-data, and is fixed in 5.7.7-tuxcare.2." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:7aa045eb-7516-5bc7-a32b-3d5fc68deb18", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-data. not_affected \u2014 Spring Security 5.7.7 is not affected by CVE-2026-59277. The vulnerable component, the InetAddressMatchers utility class with matchInternal()/matchExternal() builders for classifying IP addresses as internal or external networks, does not exist in this version. The CVE describes a misclassification vulnerability where 0.0.0.0 and :: are incorrectly treated as external addresses. However, versio...", "justification": "code_not_reachable" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.7.7-tuxcare.1" } ] }