{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:40106cdf-3979-5b7f-960d-710a179dba35", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-ldap", "purl": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.18", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.18", "version": "6.3.10-tuxcare.18", "pedigree": { "ancestors": [ { "name": "spring-security-ldap", "purl": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10", "type": "library", "group": "org.springframework.security", "version": "6.3.10" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:9c890be8-0eee-548b-a5a1-cb33efa1f897", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:359152f5-ba45-5888-a61b-b75b8df235a7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:bc0da428-0851-5bdd-b8bc-3821d1921189", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:6ffbc5d5-b52d-5c8a-8f69-4fdf83078159", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:55669c46-1798-5ebc-972f-a0d8aefd04af", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:2d2adead-7a04-5f0a-9d94-8986a39b290b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:a21ee6f3-308f-518b-91c0-fbfb73973a46", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:05d32f55-583d-53e1-91de-d52a6bd5ec37", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:b9cc2ad6-4b49-5ace-8c68-2b27c9cd5dbc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:774702d6-47ea-5b64-b4df-13f3f250c81d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:68608017-4b9b-55f2-9c61-b089793f21d7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:020246d9-0a26-5983-af65-25c9b86260b1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1258 does not affect version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-ldap. not_affected \u2014 The target Spring Security 6.3.10-tuxcare.7 is not affected by CVE-2018-1258. The vulnerability existed in Spring Framework versions 5.0.5/5.0.6 and was fixed in Spring Framework 5.0.7 (June 2018). The target depends on Spring Framework 6.1.20-tuxcare.5, which is approximately 6 years newer than the fixed version and contains all security fixes from 5.0.7 onwards.", "justification": "requires_dependency" } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:658b60ab-9e02-5fcc-a86e-c53269e61462", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:df11de6d-ec51-5bf0-ad48-7e895df0841b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:2f7df86e-835b-589b-b27f-c4bc50d3f54a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:325c70dc-bf59-5a17-af90-82e9a9313f7e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:a05a69e5-c711-5dcb-99b1-bec77b951ab6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:879156dc-e026-5d3b-8b83-747d5ca66d09", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:dd75de72-53ed-576e-988c-9418a9d86656", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:6d916116-d3b5-54e0-814b-fbc31ef34c48", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:9f6d2c8c-5be3-56ac-a945-cefd9ca5e885", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:d8e8b0b1-4aa0-52b7-bef1-75abc080e6b8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:407833be-eff0-5394-8c8c-f3ec986151f2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:2d7987a8-ff72-5f02-a0bf-c39ec341f973", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22257 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:6ca72033-a291-57d1-9cf8-ff81ea2bf67c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:b509d6ac-4e65-5fac-a208-41f8906e3312", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38827 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:ef70b991-81cb-5f4e-8dea-1543b5ba64e7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:6584ffd6-f366-5266-a2e8-9e70461c15eb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22228 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:94367a7c-64b2-554a-95c6-dbbc3767c2dc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-ldap. not_affected \u2014 The target repository (spring-security 6.3.10-tuxcare.21) is NOT AFFECTED by CVE-2025-22234. The vulnerability was fixed by upstream Spring Security in commit c1aa99fdd2113a232986e9c3a44673ae752de840 (dated 2025-04-17) before TuxCare onboarded version 6.3.10. The fix conditionalizes the 72-byte password length check to only apply when encoding new passwords (!for_check), not during authenticati...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:3db512e3-f430-5dd8-803f-d2ab03806605", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-ldap. Spring Security 6.3.10 contains a copy of the pre-fix method lookup from a TuxCare backport, but it is only used together with Spring's own annotation lookup, which finds annotations on private methods, so the CVE-2025-41232 authorization bypass cannot occur.", "justification": "code_not_reachable" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:ccf13350-c191-5a18-a3fd-69179fd396d4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41248 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:1ee859b4-505f-5b67-b62f-07cceae6affc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:a74d0174-5d94-58ea-9981-e5baabc72fd7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-ldap. not_affected \u2014 Spring Security 6.3.10 is not affected by CVE-2026-22751. The vulnerable component JdbcOneTimeTokenService was introduced in version 6.4.0, which postdates this target version. The one-time token authentication feature does not exist in 6.3.10.", "justification": "code_not_present" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:349fd364-e891-5afb-a1ef-9a3a443d6223", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47842 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-ldap, and is fixed in 6.3.10-tuxcare.20." } }, { "id": "CVE-2026-59270", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:f50a7a51-d31f-57ba-8228-09390fae289b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59270 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-ldap, and is fixed in 6.3.10-tuxcare.19." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:0e7f1070-a8ed-5b93-8695-a34d63cc3004", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59276 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-ldap, and is fixed in 6.3.10-tuxcare.20." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:4dfb23d4-03c7-5a73-95f6-4ad11ac4c185", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-ldap. not_affected \u2014 Spring Security 6.3.10 does not contain the InetAddressMatchers class or its matchInternal()/matchExternal() methods that are affected by CVE-2026-59277. The vulnerability concerns incorrect classification of \"any local\" addresses (0.0.0.0 and ::) as external rather than internal. This functionality was introduced in a later version of Spring Security (patches dated June/July 2026, after the 6....", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.18" } ] }