{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:475d4ff2-8752-589b-a1f7-8b415361e418", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-data", "purl": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.18", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.18", "version": "6.3.10-tuxcare.18", "pedigree": { "ancestors": [ { "name": "spring-security-data", "purl": "pkg:maven/org.springframework.security/spring-security-data@6.3.10", "type": "library", "group": "org.springframework.security", "version": "6.3.10" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:408dcbdb-a33d-5250-bd4c-af25ec1193bc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:88bba2eb-9ae3-582b-8de3-58e378c11a30", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:eb844ee7-4251-51fa-b781-34caab65ab5c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:581bfdb7-2470-54b4-bda9-e0bc82105616", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:1868512b-0896-542b-835e-f4508708fbd3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:5645afc5-7efa-5643-840b-41c1af499b81", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:7528f6a8-8349-5830-935e-ecdd176f4611", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:c3fe46b6-2b4a-5672-81e1-29db613a47d0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:0cfe1a9e-af60-5fa7-8ef6-cb65fa39da1f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:4541cdb3-775c-5528-872f-5a8593b86054", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:519e6612-1c3d-5f46-9dff-d93c1e619865", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:5eb2f807-b344-535f-90f3-58a648e08842", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1258 does not affect version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-data. not_affected \u2014 The target Spring Security 6.3.10-tuxcare.7 is not affected by CVE-2018-1258. The vulnerability existed in Spring Framework versions 5.0.5/5.0.6 and was fixed in Spring Framework 5.0.7 (June 2018). The target depends on Spring Framework 6.1.20-tuxcare.5, which is approximately 6 years newer than the fixed version and contains all security fixes from 5.0.7 onwards.", "justification": "requires_dependency" } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:0f166bc1-9ac6-51fa-a832-144c5e19c6ae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:25429605-6480-551d-8920-fd8fea7e8b5f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:0854e043-8912-5b86-b40b-505afebab9f8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:d0ebd721-fce9-59e6-943c-5f022df80bf8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:4275e3cb-fee0-53e2-8247-d743bf4e3071", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:edf767b0-72fb-5376-a162-3c39eaed3b5a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:49cf46d3-fdce-59ab-b920-da381cba000f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:accb47aa-754f-55ea-964b-24b72d8d33b8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:822a015f-f8c9-540b-b7a1-6d602824bc38", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:2e3cb6fa-274f-51a0-99fa-2793424772ba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:6e3108d8-f88c-5e77-8e46-485768126733", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:c107373c-ebb8-53de-b9bc-a36ead48639f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22257 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:69020095-8ba4-5baf-8084-7902c3330e99", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:4ddb29d7-fc8a-5ea2-8f10-97ed0a9b03c7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38827 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:1aff1ab9-171b-5125-add3-1ecfce33aabd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:4c8f7dee-4907-55a3-9cc3-202201c262e4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22228 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:8f825a1c-3540-5390-b053-ba2e3d643ee4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-data. not_affected \u2014 The target repository (spring-security 6.3.10-tuxcare.21) is NOT AFFECTED by CVE-2025-22234. The vulnerability was fixed by upstream Spring Security in commit c1aa99fdd2113a232986e9c3a44673ae752de840 (dated 2025-04-17) before TuxCare onboarded version 6.3.10. The fix conditionalizes the 72-byte password length check to only apply when encoding new passwords (!for_check), not during authenticati...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:b6608517-72bd-55ef-b7d9-047177872a5b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-data. Spring Security 6.3.10 contains a copy of the pre-fix method lookup from a TuxCare backport, but it is only used together with Spring's own annotation lookup, which finds annotations on private methods, so the CVE-2025-41232 authorization bypass cannot occur.", "justification": "code_not_reachable" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:248b9f9c-30be-574a-8357-84413aea4a0a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41248 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:b8bccd21-90e5-5f0e-9d63-bc53a03cf809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:c42720e4-68e1-5be0-a934-8f5b00d71c29", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-data. not_affected \u2014 Spring Security 6.3.10 is not affected by CVE-2026-22751. The vulnerable component JdbcOneTimeTokenService was introduced in version 6.4.0, which postdates this target version. The one-time token authentication feature does not exist in 6.3.10.", "justification": "code_not_present" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:6a7daf95-1e0b-547f-bc1c-b93e13363bc9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47842 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-data, and is fixed in 6.3.10-tuxcare.20." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:89a2014c-edd1-5811-af81-372352352014", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59276 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-data, and is fixed in 6.3.10-tuxcare.20." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:5f127999-91a9-593a-bb0f-57a8c9699fb7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-data. not_affected \u2014 Spring Security 6.3.10 does not contain the InetAddressMatchers class or its matchInternal()/matchExternal() methods that are affected by CVE-2026-59277. The vulnerability concerns incorrect classification of \"any local\" addresses (0.0.0.0 and ::) as external rather than internal. This functionality was introduced in a later version of Spring Security (patches dated June/July 2026, after the 6....", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.18" } ] }