{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ca198720-21f5-554b-ba6f-7007796b3094", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-ldap", "purl": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.19", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.19", "version": "6.3.10-tuxcare.19", "pedigree": { "ancestors": [ { "name": "spring-security-ldap", "purl": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10", "type": "library", "group": "org.springframework.security", "version": "6.3.10" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:58acb349-c00b-5082-8e74-361e5c427585", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:dac02240-d1ec-5bb0-81b9-c2fce562d2bf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:c034ca6b-35e2-5e63-b803-c437b330ef51", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:7788d153-5435-5b47-8678-304da1c1e480", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:9eb0305c-6a25-57f3-b186-f5dd28a5a1d4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:0373d647-e83c-555a-8d57-2b5b9117e5d6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:565c4325-1fb5-5999-9ada-de12ba2dbebe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:1baa803c-e16b-5b02-b17a-d10eb0450b27", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:64f03b03-c96a-5b96-8aff-04921e1249be", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:c1e9774c-bb69-5012-b67d-41ccb07d2c57", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:382a9118-2d14-5406-96ee-0254617e5f6d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:5c68f139-3169-5ac6-9f9f-7b6e95219995", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1258 does not affect version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-ldap. not_affected \u2014 The target Spring Security 6.3.10-tuxcare.7 is not affected by CVE-2018-1258. The vulnerability existed in Spring Framework versions 5.0.5/5.0.6 and was fixed in Spring Framework 5.0.7 (June 2018). The target depends on Spring Framework 6.1.20-tuxcare.5, which is approximately 6 years newer than the fixed version and contains all security fixes from 5.0.7 onwards.", "justification": "requires_dependency" } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:40580017-15af-5b0a-ba4d-cb127b23d89e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:e130ed2e-9c7a-51a5-9f37-94d036dae50d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:a10c27d8-673e-5b61-b013-33beea79165d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:f4629e82-a891-5915-9b12-14364365b611", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:03803892-8a48-5bb8-be15-4b514c6148e7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:20c2a5d6-3961-5cbb-a9f3-a1c298a20a25", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:e1ea7350-7e41-538e-a43f-6ac335d14373", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:84d00d58-9d91-588e-9d1a-210ff9c91351", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:f1598ecd-f7b9-59aa-8dc8-a7892e1a3e2b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:dbda6d53-6316-5162-8b21-ea99044075ec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:b91a82d1-a0ad-5029-9376-aa29f99ddfb6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:ec01e0fa-7a9b-53b1-8c95-04c74edefc2a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22257 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:600653bb-45f2-53cc-89a0-8252a21839bd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:a33df5df-13d2-5b4b-8771-c74f8c285558", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38827 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:6556fb0f-ea1f-5d00-b324-70f4bbc96c1f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:c39343ff-d548-557f-b7e2-8b19856e6ad9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22228 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:83280265-e074-578c-8570-e3266aa89d73", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-ldap. not_affected \u2014 The target repository (spring-security 6.3.10-tuxcare.21) is NOT AFFECTED by CVE-2025-22234. The vulnerability was fixed by upstream Spring Security in commit c1aa99fdd2113a232986e9c3a44673ae752de840 (dated 2025-04-17) before TuxCare onboarded version 6.3.10. The fix conditionalizes the 72-byte password length check to only apply when encoding new passwords (!for_check), not during authenticati...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:b98bc1cd-fb71-5360-b108-90d747823ef3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-ldap. Spring Security 6.3.10 contains a copy of the pre-fix method lookup from a TuxCare backport, but it is only used together with Spring's own annotation lookup, which finds annotations on private methods, so the CVE-2025-41232 authorization bypass cannot occur.", "justification": "code_not_reachable" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:40ceff9c-40bd-59ab-8f99-1653501c63a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41248 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:fa94b602-08f3-541a-a5b5-9eb705dd64ce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:d9be39e3-e29b-52c9-8f91-bc0eb7711f17", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-ldap. not_affected \u2014 Spring Security 6.3.10 is not affected by CVE-2026-22751. The vulnerable component JdbcOneTimeTokenService was introduced in version 6.4.0, which postdates this target version. The one-time token authentication feature does not exist in 6.3.10.", "justification": "code_not_present" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:412179d8-5419-53aa-bb0b-acff19dc138f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47842 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-ldap, and is fixed in 6.3.10-tuxcare.20." } }, { "id": "CVE-2026-59270", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:931d854e-8bb7-5feb-aadf-f6610c722a93", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59270 is fixed in version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:9ad35b50-5316-503c-bf9b-282985990619", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59276 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-ldap, and is fixed in 6.3.10-tuxcare.20." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:fd1311fc-2f86-5366-b376-8ed827196471", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-ldap. not_affected \u2014 Spring Security 6.3.10 does not contain the InetAddressMatchers class or its matchInternal()/matchExternal() methods that are affected by CVE-2026-59277. The vulnerability concerns incorrect classification of \"any local\" addresses (0.0.0.0 and ::) as external rather than internal. This functionality was introduced in a later version of Spring Security (patches dated June/July 2026, after the 6....", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.19" } ] }