{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d1c5234b-6fbe-5a22-85fe-09bef4af20c4", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-ldap", "purl": "pkg:maven/org.springframework.security/spring-security-ldap@6.0.8-tuxcare.5", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.0.8-tuxcare.5", "version": "6.0.8-tuxcare.5", "pedigree": { "ancestors": [ { "name": "spring-security-ldap", "purl": "pkg:maven/org.springframework.security/spring-security-ldap@6.0.8", "type": "library", "group": "org.springframework.security", "version": "6.0.8" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:1fb4fcfc-e7a9-5019-9063-16978b561f8f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:03f9edae-2796-50be-ab49-0716b8601596", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:dc924a70-b166-58bb-8274-e67152fc2a1a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:eea5ee20-3007-5089-8094-5b57fa0d57a7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:60035ff1-0897-56a8-a64f-b5a030130787", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:e5805b63-fa91-58f9-be1c-69db0baa2172", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:c31ea3e4-3708-5eac-bcef-b06a027f987d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:eb38334b-8f53-5d48-a3c5-40da56971453", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:3cdefd90-e33c-5243-b45b-0d514cc4ca1c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:c3e80e12-0997-5557-ac50-fbc7f0ed63d7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:5cf01b06-dca6-5370-bcd3-e5ae35ba4610", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:ebc759e4-f2a2-5e0e-a687-83b6246f2d58", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:b9d0db30-e634-522b-a713-89065f4ba28f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:ee265e85-5241-516f-a8de-d50c4964ccc5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:b193375d-2ca6-560a-afb0-65a727a192d0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:4222cce8-4d59-5ade-ae9a-a6e6049fb71b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:4066728a-e380-5ac1-ada4-11911089ee45", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:3f9dc914-fe5e-5e6a-9ceb-b9cf2a7d7805", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:8272547e-0b6a-5bde-8e78-8824d1239351", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:499975b2-64be-58cf-af30-0a105ecd90ff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:b6f85e9a-a79a-59fd-8334-55a475594acf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:604df3a8-259d-5542-9c96-7bc42d74b0da", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:08216a1d-e007-5d33-bed6-d97f460c00a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22257 is fixed in version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:b5ae4c1d-5fae-5f55-ab6c-f35958847176", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:4f96a993-d964-52c1-b213-4a77c7a81fe1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38827 is fixed in version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:4a154e49-12cf-506e-b8b7-cbdfa94bd2cd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:4b75228f-fb8e-5fcf-9339-3ad4e9c62484", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22228 is fixed in version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:fcb085a3-7607-5cc0-bd3f-4760a123cf6e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22234 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:41df08d4-f400-56a4-ac48-7088d8979440", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41232 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:b615146e-3184-5871-a89e-ac7459378338", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41248 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:2ea604d4-7ff4-5a9c-a82f-a4dcc626a912", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:93288006-7a0a-5935-acc4-c9d4e6262820", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-ldap. not_affected \u2014 Spring Security version 6.0.8 is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService and the entire one-time token authentication feature) does not exist in this version. The one-time token login feature was introduced in Spring Security 6.4.0-RC1, released after version 6.0.8. Exhaustive searches across the codebase confirmed no OneTimeToken classes, JdbcOneTimeTo...", "justification": "code_not_present" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:b300ce59-9961-50da-8677-a9b5be549878", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2026-59270", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:9fb0e530-5183-5c40-b578-c16e6749f360", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59270 is fixed in version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:9b686718-219e-505f-b614-147ed3c2ab5b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:8b98a455-a147-5fd2-8a6b-fbdba9df0edf", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-ldap. not_affected \u2014 Spring Security 6.0.8 is not affected by CVE-2026-59277. The vulnerability exists in the `InetAddressMatchers` utility class with its `matchInternal()` and `matchExternal()` methods, which do not exist in version 6.0.8. This class was introduced in a later version of Spring Security (after 6.5.11). Without this utility, there is no mechanism to classify IP addresses as internal/external, and th...", "justification": "code_not_reachable" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.0.8-tuxcare.5" } ] }