{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8d06c741-c243-5477-89b1-97aa3005f960", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-ldap", "purl": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.20", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.20", "version": "6.3.10-tuxcare.20", "pedigree": { "ancestors": [ { "name": "spring-security-ldap", "purl": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10", "type": "library", "group": "org.springframework.security", "version": "6.3.10" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:2a343819-da32-57ed-ad8a-629564404b07", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:7261e985-a800-5e0c-96b4-4e7648a4af97", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:ebd64519-a372-5656-b2bc-91f7bd1304f3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:88162758-6043-5b37-b72e-2fbfd15e4f70", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:789aa7f6-30df-526c-89fc-95040d6a3a99", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:22cb9625-e9ae-5b97-94aa-196e24ee13b7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:77250dfa-cd98-5e8b-a914-e7e85bd36624", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:f0328279-bd65-5bbc-8576-934fea8e8d35", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:b80d608d-4cc8-5eda-aae6-7e0d8cea3a62", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:a88d8d68-5650-5902-8b8e-de4af6c3d5d6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:043fcbd6-c850-5466-a02c-cf81635f99b0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:dfe8732c-ede1-5a84-8348-6b74042a5d72", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1258 does not affect version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-ldap. not_affected \u2014 The target Spring Security 6.3.10-tuxcare.7 is not affected by CVE-2018-1258. The vulnerability existed in Spring Framework versions 5.0.5/5.0.6 and was fixed in Spring Framework 5.0.7 (June 2018). The target depends on Spring Framework 6.1.20-tuxcare.5, which is approximately 6 years newer than the fixed version and contains all security fixes from 5.0.7 onwards.", "justification": "requires_dependency" } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:e7c707a1-d668-502a-a88b-b347616e95ea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:52f06187-e0ce-54b8-b789-f6b8b112a94f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:0beb2758-584f-5fef-96e5-fc7b847c7db7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:09270364-c69c-5203-8313-fedfab000871", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:297e9c69-ff44-5538-a09f-e2877796909f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:484e9061-91cf-53dd-a0ec-3f39c6218493", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:c8a9037d-a68f-5f7f-ac79-95bf0425a564", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:f7660e06-1fef-5d2b-8d4a-6fa6fb38ae7f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:61009557-dce0-55b0-98e1-4701cebffe54", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:1856a117-b038-5bfb-b37d-0b3087a6f8e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:8ec838da-c80d-515e-9a5a-f90f4ebcaab1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:7b6fd8ca-2e16-59a5-8671-6ad35c91dbf2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22257 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:021f8762-b04e-5e9f-b251-0a47828f9533", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:5c0fb463-a499-5b2b-8bef-f3584983a875", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38827 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:1a4628d2-829b-5f45-8049-915dcb2c031c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:c8f2703e-1909-5f60-a004-25ee0703bb27", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22228 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:b63c906f-f2f7-5926-9e1c-b071d070aa5a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-ldap. not_affected \u2014 The target repository (spring-security 6.3.10-tuxcare.21) is NOT AFFECTED by CVE-2025-22234. The vulnerability was fixed by upstream Spring Security in commit c1aa99fdd2113a232986e9c3a44673ae752de840 (dated 2025-04-17) before TuxCare onboarded version 6.3.10. The fix conditionalizes the 72-byte password length check to only apply when encoding new passwords (!for_check), not during authenticati...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:a54c40e8-0119-5508-a4c8-c4d6e5970f60", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-ldap. Spring Security 6.3.10 contains a copy of the pre-fix method lookup from a TuxCare backport, but it is only used together with Spring's own annotation lookup, which finds annotations on private methods, so the CVE-2025-41232 authorization bypass cannot occur.", "justification": "code_not_reachable" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:87af90f6-b44e-5dd4-ba89-b02506e85e78", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41248 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:2e06e569-fd55-5bca-9664-9dabc2b64074", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:d99a411a-b44c-52f9-a417-1dcece4c1479", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-ldap. not_affected \u2014 Spring Security 6.3.10 is not affected by CVE-2026-22751. The vulnerable component JdbcOneTimeTokenService was introduced in version 6.4.0, which postdates this target version. The one-time token authentication feature does not exist in 6.3.10.", "justification": "code_not_present" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:6fb7cb9d-8002-5f5a-ae16-bc6eab52c48f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2026-59270", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:fc7a6603-93b9-54f6-a413-bb6ffca65942", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59270 is fixed in version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:89dd0904-0b60-5b2c-ae22-8eb2bd0a163c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-ldap." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:d5710d4d-98d6-5d19-9d2c-29121d3c486d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-ldap. not_affected \u2014 Spring Security 6.3.10 does not contain the InetAddressMatchers class or its matchInternal()/matchExternal() methods that are affected by CVE-2026-59277. The vulnerability concerns incorrect classification of \"any local\" addresses (0.0.0.0 and ::) as external rather than internal. This functionality was introduced in a later version of Spring Security (patches dated June/July 2026, after the 6....", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-ldap@6.3.10-tuxcare.20" } ] }