{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ae465c6a-2c33-54ce-8b5d-ef4612ac6151", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-ldap", "purl": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.17", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.17", "version": "6.3.10-tuxcare.17", "pedigree": { "ancestors": [ { "name": "spring-security-ldap", "purl": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10", "type": "library", "group": "org.springframework.security", "version": "6.3.10" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:0f3746fc-1a64-5035-992d-57f78b83fd99", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:247bcaf9-f39a-5e6f-aea0-c79eb68e8372", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:6db39bd8-8310-5a2d-ae2c-1800e4ac5f7c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:2b6e54af-8935-538f-b857-c9114b35a086", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:35198057-1693-5745-9d85-ee507649f335", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:9649d1e5-8e93-59b2-8bba-b69281d0df90", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:3f75572e-aa9a-561e-b647-92f9768ba295", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:dfbd6d25-24bb-500e-88fa-c59a37c7e225", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:1654f1e1-ba5f-53c4-bbdd-47fdab603c88", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:72159d5d-0845-5321-950e-bf6595bf88a1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:fdfb2621-b89d-5c3b-8921-2f50372d200c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:e29ca322-6393-581d-a203-08e4378d9548", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1258 does not affect version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-ldap. not_affected \u2014 The target Spring Security 6.3.10-tuxcare.7 is not affected by CVE-2018-1258. The vulnerability existed in Spring Framework versions 5.0.5/5.0.6 and was fixed in Spring Framework 5.0.7 (June 2018). The target depends on Spring Framework 6.1.20-tuxcare.5, which is approximately 6 years newer than the fixed version and contains all security fixes from 5.0.7 onwards.", "justification": "requires_dependency" } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:18977945-168c-5f17-ad11-59ecb60fe857", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:df8a4ef6-30d6-5527-b1e5-1d7b276f4ae8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:959aa643-4fda-5119-9ea9-0c30ba1322ab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:8ddb3a73-3d3c-5d99-b416-ec15e485aacb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:0d30e899-ad11-5cb9-915a-d3947d2342ba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:67d6274b-d5e9-52e7-acfe-58cc204a72e4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:11cd9f96-7ab7-53aa-a0b1-a1f16edd3a4e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:e35a9f4b-d3af-527d-9820-7c98cd597e74", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:f026108b-5de9-5edf-aefb-0ec4b000f13b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:bcf69ddc-7a96-57d6-a990-7beb9c672dcb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:1eb378dc-c840-59c7-82bb-e4aeb3a23bd0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:f9d8ebbe-81b1-5dfe-94ea-f6fc9b2fb86a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22257 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:6c1ba0f0-8487-5c05-a43b-9d1402634774", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:95e70545-dafb-5765-821a-19eacce0d46f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38827 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:4bda8f9e-6b2f-57a7-94f3-b06d4cb975e8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:4ea6123c-c9a5-59f6-9de3-f7dad5d30aad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22228 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:14a34152-5747-5d54-b0ca-fed7d9150fea", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-ldap. not_affected \u2014 The target repository (spring-security 6.3.10-tuxcare.21) is NOT AFFECTED by CVE-2025-22234. The vulnerability was fixed by upstream Spring Security in commit c1aa99fdd2113a232986e9c3a44673ae752de840 (dated 2025-04-17) before TuxCare onboarded version 6.3.10. The fix conditionalizes the 72-byte password length check to only apply when encoding new passwords (!for_check), not during authenticati...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:6cf8ea2a-e671-5464-8cc3-15d51f0e2055", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-ldap. Spring Security 6.3.10 contains a copy of the pre-fix method lookup from a TuxCare backport, but it is only used together with Spring's own annotation lookup, which finds annotations on private methods, so the CVE-2025-41232 authorization bypass cannot occur.", "justification": "code_not_reachable" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:c14ba737-f1e5-54dd-9999-32d4e21b5173", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41248 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:66db6d65-86e3-566b-ba0a-a4089c063998", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:88b03fda-be47-5b52-a974-c653bbfadfc2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-ldap. not_affected \u2014 Spring Security 6.3.10 is not affected by CVE-2026-22751. The vulnerable component JdbcOneTimeTokenService was introduced in version 6.4.0, which postdates this target version. The one-time token authentication feature does not exist in 6.3.10.", "justification": "code_not_present" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:02bfc347-c5b3-5c54-ae86-35e19e4b94c4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47842 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-ldap, and is fixed in 6.3.10-tuxcare.20." } }, { "id": "CVE-2026-59270", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:9ac61897-0b80-5883-a8a8-0a54ce416e42", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59270 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-ldap, and is fixed in 6.3.10-tuxcare.19." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:b6997105-a809-5751-a79f-3a1273f7e674", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59276 affects version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-ldap, and is fixed in 6.3.10-tuxcare.20." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.17" } ], "bom-ref": "urn:uuid:acbc1742-0685-550e-98f2-54c28e0743e7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.3.10-tuxcare.17 of org.springframework.security:spring-security-ldap. not_affected \u2014 Spring Security 6.3.10 does not contain the InetAddressMatchers class or its matchInternal()/matchExternal() methods that are affected by CVE-2026-59277. The vulnerability concerns incorrect classification of \"any local\" addresses (0.0.0.0 and ::) as external rather than internal. This functionality was introduced in a later version of Spring Security (patches dated June/July 2026, after the 6....", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.17" } ] }