{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:791fafa4-f2ac-5a6e-b5b7-e8bff48500ba", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-data", "purl": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.19", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.19", "version": "6.3.10-tuxcare.19", "pedigree": { "ancestors": [ { "name": "spring-security-data", "purl": "pkg:maven/org.springframework.security/spring-security-data@6.3.10", "type": "library", "group": "org.springframework.security", "version": "6.3.10" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:defdbaec-bd97-5120-96be-a4dd221e9519", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:e61d22fd-a7e2-521e-9a9c-0096444fe800", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:a8017078-9bd5-573a-b886-719250ede0db", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:52069772-3380-5561-a367-d277794c1bdf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:4b82d0c3-f002-5f32-8036-cd0cbd69bd17", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:da369d0e-f0db-5107-b90f-cfd3272667c0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:0ce9e497-3036-5a97-8caa-af5cf960d8e0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:0c1b40ca-92f7-554d-90cb-d38c1296e079", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:db7709c4-6c89-5234-aef3-9e22339b3290", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:b55c4ce6-eafd-5221-9339-b57f56b6efe3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:f4726dea-5f81-5818-b7af-eb0c76073de4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:6bbf93ca-f079-56c3-88db-9320762f3230", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1258 does not affect version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-data. not_affected \u2014 The target Spring Security 6.3.10-tuxcare.7 is not affected by CVE-2018-1258. The vulnerability existed in Spring Framework versions 5.0.5/5.0.6 and was fixed in Spring Framework 5.0.7 (June 2018). The target depends on Spring Framework 6.1.20-tuxcare.5, which is approximately 6 years newer than the fixed version and contains all security fixes from 5.0.7 onwards.", "justification": "requires_dependency" } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:4987c5cf-ae0c-5444-b094-1b57288ba3ac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:991057a6-eb9a-538c-9eff-8e0cd3cbf730", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:b095e4f7-a98a-5105-a2d5-7875ca02e62d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:f0d67abd-b38e-58d5-b8b0-c91d6268c3aa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:1dc03009-612a-5a5a-a265-cf784421e1f4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:0825d6eb-8af8-530c-9055-f6566b919226", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:3f615a60-9ca5-5865-8f27-dc498b42adc6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:48cb95fb-4602-5b50-b670-5cb747832587", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:5a5cd1e1-b617-5c4d-a34f-c4e371fe8572", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:a7e5c3cb-e92e-56e5-8ccb-be2c8178becf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:866616dd-eb69-5bc2-9dd3-6d4a496b238b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:4724209d-fd90-5db0-856d-fa3aff23c312", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22257 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:d00f6e1c-73d0-5cf5-91be-551eaa4bc55f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:5e74d67d-12bb-5e3a-b495-aa2f9f578918", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38827 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:34a1bc29-d194-5411-a735-7a1caa723c63", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:b1b5c154-4f48-5804-8ead-d0c8635f5649", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22228 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:4f743ebd-0b6d-56a3-836a-b178b4d01320", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-data. not_affected \u2014 The target repository (spring-security 6.3.10-tuxcare.21) is NOT AFFECTED by CVE-2025-22234. The vulnerability was fixed by upstream Spring Security in commit c1aa99fdd2113a232986e9c3a44673ae752de840 (dated 2025-04-17) before TuxCare onboarded version 6.3.10. The fix conditionalizes the 72-byte password length check to only apply when encoding new passwords (!for_check), not during authenticati...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:17a7685d-449f-5ffb-85ad-c641f5499ebc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-data. Spring Security 6.3.10 contains a copy of the pre-fix method lookup from a TuxCare backport, but it is only used together with Spring's own annotation lookup, which finds annotations on private methods, so the CVE-2025-41232 authorization bypass cannot occur.", "justification": "code_not_reachable" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:1863239e-51e7-5116-b315-7ca66af87b28", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41248 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:bff42c07-fae7-5661-9d67-6d809947be08", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:2f3ce9f2-600a-55bf-8a3c-adf6136d61f2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-data. not_affected \u2014 Spring Security 6.3.10 is not affected by CVE-2026-22751. The vulnerable component JdbcOneTimeTokenService was introduced in version 6.4.0, which postdates this target version. The one-time token authentication feature does not exist in 6.3.10.", "justification": "code_not_present" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:d6e453f8-15de-5579-b367-225f85d02c4f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47842 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-data, and is fixed in 6.3.10-tuxcare.20." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:27ee7cdc-9fc7-5829-b50b-a250fe3304d5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59276 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-data, and is fixed in 6.3.10-tuxcare.20." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:f7550fba-7341-520e-8570-388ebd063788", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-data. not_affected \u2014 Spring Security 6.3.10 does not contain the InetAddressMatchers class or its matchInternal()/matchExternal() methods that are affected by CVE-2026-59277. The vulnerability concerns incorrect classification of \"any local\" addresses (0.0.0.0 and ::) as external rather than internal. This functionality was introduced in a later version of Spring Security (patches dated June/July 2026, after the 6....", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.10-tuxcare.19" } ] }