{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c165078a-5847-5865-a249-4b18fc788aa6", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-data", "purl": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.4", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.4", "version": "6.0.8-tuxcare.4", "pedigree": { "ancestors": [ { "name": "spring-security-data", "purl": "pkg:maven/org.springframework.security/spring-security-data@6.0.8", "type": "library", "group": "org.springframework.security", "version": "6.0.8" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:f0e46e40-3873-5b85-a837-a2d87907ec4d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:0d6ec627-463e-5f27-97ca-22f71a5dc093", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:7870d640-ec15-5637-a336-000523f4c549", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:fac193f4-4a19-5285-8cc6-b52728db81a4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:b83ff24d-9bf1-5b78-9dcd-63940c510fad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:0a30bb13-ff78-57c9-9694-d8f23d02c5cf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:326ec5b1-bc21-5462-a0b1-67f291079049", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:cde1efb6-d9c4-5d16-89dd-667f5f84ce4d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:e5f06ed0-9252-5b3f-ab3e-fe13afd3a786", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:9b5ec5ae-c2d6-50dd-b705-c0cdeb4124ec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:ce42458c-5321-5317-aadc-21cdac01f1b3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:977c65c8-6674-5b21-a6ec-811e7e61d4fb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:a4373989-80a9-5c0e-b92d-eaf25cb058af", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:4a85bd1c-5178-50f7-96a0-7d55e671234b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:9d90cbcd-44e2-527a-bdf0-76120de9b0c8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:97e07d96-3163-5b9b-a681-e402fc3f510d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:964da895-8d69-5555-8ccf-15b1defe54b1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:f1f99764-5559-5bb6-bc61-a02ce8c25d3f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:610468c9-c8ab-56fc-b09b-8cec515e15fd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:3fc3979d-8f77-54ff-b0d7-0edae04e2297", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:a0e09b48-55de-5ccd-bcd5-b79fd6c7872c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:364a9e23-816d-52f4-9689-d2a660934ae1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:2f1d6ac6-7350-598d-8379-35f59ea50659", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22257 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:89b5b327-1062-56f7-b35d-1bae8b3f09f7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:4ec08bcb-90ff-5979-9b44-24bdbba92965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38827 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:7768070b-9935-5ea2-b2a4-66f4c77b9937", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:04802205-1ea9-565f-b562-3b1c138363fe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22228 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:a88b3d35-b1b8-528d-bb66-58f0e5c7de09", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22234 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:fa0db068-ee35-5c7a-9d82-8843092c6f62", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-data. Spring Security 6.0.8 contains a copy of the pre-fix method lookup from a TuxCare backport, but it is only used together with Spring's own annotation lookup, which finds annotations on private methods, so the CVE-2025-41232 authorization bypass cannot occur.", "justification": "code_not_reachable" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:9374477e-6809-5f2b-8fe2-5d2b33fd2516", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41248 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:e5dbb1d9-a139-5b0e-89db-7a9e5f66b943", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:1fdb1ded-39cb-53a0-873e-0b14c66c787a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-data. not_affected \u2014 Spring Security version 6.0.8 is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService and the entire one-time token authentication feature) does not exist in this version. The one-time token login feature was introduced in Spring Security 6.4.0-RC1, released after version 6.0.8. Exhaustive searches across the codebase confirmed no OneTimeToken classes, JdbcOneTimeTo...", "justification": "code_not_present" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:ea5f458a-2b01-5f5a-a114-87cb539c3560", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:096fb98e-01b6-5f30-9f98-fd7d801c8691", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:bf21e102-6f12-57f6-aa32-e5edf3dc2255", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-data. not_affected \u2014 Spring Security 6.0.8 is not affected by CVE-2026-59277. The vulnerability exists in the `InetAddressMatchers` utility class with its `matchInternal()` and `matchExternal()` methods, which do not exist in version 6.0.8. This class was introduced in a later version of Spring Security (after 6.5.11). Without this utility, there is no mechanism to classify IP addresses as internal/external, and th...", "justification": "code_not_reachable" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.4" } ] }