{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f92106e7-f86d-59e2-be2b-9417b4921978", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-ldap", "purl": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.3", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.3", "version": "5.7.7-tuxcare.3", "pedigree": { "ancestors": [ { "name": "spring-security-ldap", "purl": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7", "type": "library", "group": "org.springframework.security", "version": "5.7.7" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:5aae04ec-92d6-5f2e-89a2-d17e0f578a23", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:457660aa-739a-57ca-bcbd-948a79a604c5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:fe150b69-0a28-5a70-850d-e1c96c148aa1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:52b91d3e-7b97-539a-864c-d508dea830f4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:ebecaab2-4153-597c-bd3f-f06ae78cbc45", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:9e2c42dd-04eb-5bd1-a6fd-9cf403198d4c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:6e5355f0-a252-5ff6-96e8-2e6942fa4bd1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:fb68dc2c-e72e-5cd3-aa25-c48ed4a1fa91", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:d56fc308-35a5-5209-bda3-9a1ca89263ef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:f2865501-9be7-52c6-8a0f-1dff255cb1d2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:c8928b4c-1354-515e-af60-262717319296", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:c32ba022-29c7-523a-bb0d-354749711fa5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:0da9af11-8c37-5062-90b2-83029dde7f60", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:900ac890-c929-5394-b9ae-6bfedd138d8a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:2fba4bf3-c452-5ef9-a109-5a810a2c2ab6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:500ebbf7-9f83-5803-8a77-285c6367b201", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:947fe35a-41f4-561c-b10c-e84bcba21de0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:888443bf-750e-55b5-8491-ef8eed64a192", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:983ad23c-1cbf-5a94-a731-457b0c27342d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:8d87b805-1543-5b45-b1d7-e9bff2e5c4e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:4ca8e8af-6def-58db-ac1e-c2bf2f8e7607", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:29cd5e10-6b3c-5ad5-9e3f-d3e9165d3bac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:84970d1e-aea2-5039-a323-b31acbbd5055", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22257 is fixed in version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:8ba42c3d-3cdf-5f32-8e71-989772f6a5cb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:db808932-c731-599f-b29b-689411a827c3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38827 is fixed in version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:2873f687-33a6-5422-acb6-52b54721a201", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:0019808e-f132-5ab9-997e-d64c1a6027ef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22228 is fixed in version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:cdc85fb8-4b21-5b6a-b7ed-04eb3dab55a2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-ldap. not_affected \u2014 Spring Security 5.7.7 is not affected by CVE-2025-22234. This CVE is a secondary vulnerability introduced by the fix for CVE-2025-22228, which added a password length check to BCrypt that broke timing attack mitigation. The target version (5.7.7) never received the CVE-2025-22228 fix, and therefore does not contain the problematic code that causes CVE-2025-22234. The timing attack mitigation in...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:9527d192-1ebf-53cd-82c0-977107a658ad", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-ldap. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.7.7 does not contain that scanner, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:ded52bac-ff75-5799-b055-829651f61d31", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41248 does not affect version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-ldap. Spring Security 5.7.7 has no generic-type annotation matching of its own: method security looks annotations up through Spring Framework's annotation utilities, so the CVE-2025-41248 code is not present. The equivalent issue in Spring Framework is tracked as CVE-2025-41249.", "justification": "code_not_present" } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:abca4d95-f84a-5bf7-9abd-f7d1d0dfbe70", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:9a33ea09-b68f-5102-9e16-1236c6f20f50", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-ldap. not_affected \u2014 Spring Security 5.7.7 is not affected by CVE-2026-22751 because the vulnerable component (JdbcOneTimeTokenService) does not exist in this version. The One-Time Token (OTT) authentication feature was introduced in Spring Security 6.4.0, and version 5.7.7 predates this feature entirely. Comprehensive searches across the codebase found no JdbcOneTimeTokenService class, no OneTimeToken-related code...", "justification": "code_not_present" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:a7fd63d5-be7b-58f4-9829-2194e2214088", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2026-59270", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:e2ade6e6-c906-5712-ac24-e11030004f64", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59270 is fixed in version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:7913a9a6-5f5a-543a-bb9f-32b691f12aef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:5eb0327d-9202-5714-a49d-08589bff8f57", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-ldap. not_affected \u2014 Spring Security 5.7.7 is not affected by CVE-2026-59277. The vulnerable component, the InetAddressMatchers utility class with matchInternal()/matchExternal() builders for classifying IP addresses as internal or external networks, does not exist in this version. The CVE describes a misclassification vulnerability where 0.0.0.0 and :: are incorrectly treated as external addresses. However, versio...", "justification": "code_not_reachable" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@5.7.7-tuxcare.3" } ] }