{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:841df16a-ee13-5122-a670-3bc6ac16550e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-data", "purl": "pkg:maven/org.springframework.security/spring-security-data@6.0.7-tuxcare.2", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.7-tuxcare.2", "version": "6.0.7-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-security-data", "purl": "pkg:maven/org.springframework.security/spring-security-data@6.0.7", "type": "library", "group": "org.springframework.security", "version": "6.0.7" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:acf5b99a-88e8-58a3-8409-d75d68b83d9a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:b97e4ac6-1d12-50ec-9db6-c9b734a7772f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:f30071e8-3a53-5a67-bea8-9a9d79d91583", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:129830bf-6b0c-5f7e-88f5-01bed615974f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:b5d23edf-1527-548f-9cd7-d065b57aae36", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:64aa5b0b-405d-54a1-8288-afe25e99d28f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:c384d957-75a1-5a3e-9139-bbef2eaf1f95", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:d00a241b-8b96-5bb4-ac01-e324a40f3420", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:705aaa1d-c1e2-56f9-8250-6612dc722bf3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:2537eb9a-6e24-5414-b588-61d745cad666", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:a98855ac-2c2a-5b90-b289-5dfbcbd9db36", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:a36ad2b5-3bb2-5f59-9953-7b15f460f344", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:8cabba2c-c897-576d-9216-c72dcab97238", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:63141805-2007-5ee0-bd3b-6331eb199468", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:7929072c-6627-58ff-848c-b8d28faaa60e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:ffab932d-2439-5d7a-a9ea-119455170f57", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:f259b5bc-ae3b-59ac-9c46-db3d9e9c66d8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:45d904f5-4ce8-5f78-8715-3245bfba82dd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:fd362978-fc0c-5eb8-bfee-b015a97349c8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:d5aee157-be23-5fb7-9993-a53be20db3a0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:a7631614-1607-5dea-bff8-61cbc2b638e7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:7d6b4561-27b1-590d-be5a-5a317311b7a3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:67d05f7f-c440-568d-b7a0-412f378d5199", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22257 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:b3884aa2-bfa4-5adc-afa2-25185afe7d9f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:6c21c684-3576-5ede-b23b-f21db26a91bf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38827 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:02d5088b-a517-5930-801d-5ee6208c654f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:df16f1bb-f41b-54fa-b11f-9d952371809e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22228 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:06a40bec-a197-5bab-8ab8-801f6d16977f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22234 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:49a1cf5c-82e6-515c-8f2b-ee9c423d4e5e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-data. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 6.0.7 does not contain that scanner, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:f4993aa3-f80f-5968-9063-2a6f9a180833", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41248 does not affect version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-data. Spring Security 6.0.7 has no generic-type annotation matching of its own: method security looks annotations up through Spring Framework's annotation utilities, so the CVE-2025-41248 code is not present. The equivalent issue in Spring Framework is tracked as CVE-2025-41249.", "justification": "code_not_present" } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:22c338d2-57b0-5a29-827e-c22d77f5145c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:4e25d8fa-9c0e-5c3a-9e5b-464cb0c64b0f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-data. not_affected \u2014 CVE-2026-22751 does not affect Spring Security 6.0.7. The vulnerable component (JdbcOneTimeTokenService) and the entire One-Time Token (OTT) authentication feature were introduced in Spring Security 6.4.0-RC1, which postdates version 6.0.7 by several minor versions. The target codebase contains no OTT-related code, classes, or interfaces. This is a Rule 5 Type A1 case: the INPUT type (one-time ...", "justification": "code_not_present" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:74d9110c-3895-5445-b6e4-4d9414d3fd39", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:00a0def6-1e52-5f51-920f-67b2a77662a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:aa9b0a5a-dcb2-5f37-bcab-185852f47788", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-data. not_affected \u2014 Spring Security 6.0.7 is NOT AFFECTED by CVE-2026-59277. The vulnerable component `InetAddressMatchers` and its `matchInternal()`/`matchExternal()` methods do not exist in this version. The class was introduced in Spring Security 7.1 (confirmed via upstream @since annotation), several major versions after 6.0.7. While version 6.0.7 processes IP addresses via `IpAddressMatcher`, this class only ...", "justification": "code_not_reachable" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.7-tuxcare.2" } ] }