{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c85d3a6e-de29-5a55-bad8-74ccd9e48ed4", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-openid", "purl": "pkg:maven/org.springframework.security/spring-security-openid@5.1.5.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-openid@5.1.5.RELEASE-tuxcare.1", "version": "5.1.5.RELEASE-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-security-openid", "purl": "pkg:maven/org.springframework.security/spring-security-openid@5.1.5.RELEASE", "type": "library", "group": "org.springframework.security", "version": "5.1.5.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a47c1ed9-030b-5870-96e1-0d3c3285e8c7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-openid." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b5994ee8-6a68-5be8-b4d9-a3a7c8e30dc7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-openid." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d431aa56-e743-5eb4-bc1e-1d97b9d7bbdf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-openid." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:89f12f73-37d2-5738-8f9e-4be8fda184ce", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-openid." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2d6e609e-f891-538c-9df3-b76760a7bc69", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-openid." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0caa8b1e-93d1-52d3-bc95-5b4a6c5a9be4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-openid." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5b7a7196-b7d0-5e4c-97fd-3e0584cc6b29", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-openid." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2e08e85d-3ddc-5052-8fa5-dc14eada4918", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-openid." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5d18b32f-c30e-5c66-b26e-29a66ea56778", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-openid." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a04478a3-c147-5132-97dc-042aa6b9d0e7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-openid." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8e9d88ad-9671-547a-927a-cdb7ee5d6cab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-openid." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f2037ea7-5a6b-5a43-9167-9d66e2f87468", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-openid." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:313709d5-ac0e-54c9-9496-6f849bf5638a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-openid." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:801f1b39-c736-5717-80da-106cc438f416", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-3795 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-openid. not_affected \u2014 The target repository (Spring Security 5.1.5.RELEASE-tuxcare.1) is NOT AFFECTED by CVE-2019-3795. The vulnerability involved insecure randomness when SecureRandomFactoryBean#setSeed was used to configure a SecureRandom instance - specifically, calling setSeed() before any random bytes were generated would cause the user-provided seed to REPLACE the entire internal RNG state rather than suppleme...", "justification": "code_not_present" } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:cf623881-60e7-5c0f-964d-1a13bf7d2aac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-openid." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:933c9381-9f21-53d8-9a0f-d7e2158d809b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-openid." } }, { "id": "CVE-2021-22112", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0bf13233-e92b-578c-bb2f-5c6e346cbb95", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22112 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-openid." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:841a467a-8341-542e-b1de-8e39ad1fe408", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-openid." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:252a8b78-7d06-5169-950f-f0b97b5c585c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-openid." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f983bc1d-c0e7-5b8d-b89c-a8b57a7582c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22978 is fixed in version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-openid." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ced57573-0abc-5edb-a6b4-1c52ce7348d8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-openid." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:278778bc-ff8b-5636-bdd9-bfc617b46344", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-openid." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ccb9b310-bb44-5cdd-95c9-1c5124985d22", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-openid." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:555ad9fe-be4c-5a4f-9c1c-72047d303ea0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22257 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-openid." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:949c1d83-b04c-5eec-ac03-2f839d4f4495", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-openid." } }, { "id": "CVE-2024-38821", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:efb7afc7-5c98-5db6-a499-e7e20ee4ef42", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38821 is fixed in version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-openid." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a7103125-69c3-5725-8f1d-eb93832035c8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38827 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-openid." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:012fc13c-bebb-56a1-8fd8-7047183063c7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22223 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-openid. not_affected \u2014 Spring Security 5.1.5.RELEASE is not affected by CVE-2025-22223. The vulnerability requires @EnableMethodSecurity and the UniqueSecurityAnnotationScanner class, both introduced in Spring Security 6.0.0. Version 5.1.5 uses @EnableGlobalMethodSecurity with PrePostAnnotationSecurityMetadataSource, which relies on Spring Framework's ClassUtils.getMostSpecificMethod() to correctly resolve annotation...", "justification": "code_not_present" } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4cc3a476-1be3-5248-b05f-d818795a3974", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-openid. not_affected \u2014 Target version 5.1.5.RELEASE is not affected by CVE-2025-22234. This CVE fixes a timing attack vulnerability introduced by CVE-2025-22228, which added an unconditional 72-byte password length check that broke timing attack mitigation in DaoAuthenticationProvider. The target does not have CVE-2025-22228 applied, therefore it cannot have the timing oracle vulnerability that CVE-2025-22234 address...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:05822339-367d-5d28-aff3-719c263ff3c8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41232 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-openid." } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9d6293ad-1f1e-5d07-9edc-961c4d0e75fc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41248 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-openid." } }, { "id": "CVE-2026-22732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:67619ab2-e2a7-5308-a334-c914b95b70d5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22732 is fixed in version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-openid." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f76c736d-3071-5c61-b6ab-fb07ac9f2ac3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-openid." } }, { "id": "CVE-2026-22747", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:26eb3128-3b03-531a-900f-1b298fb1701f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22747 is fixed in version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-openid." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a874d8d5-d17b-5dd1-9fbc-b9cd238a1bd5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-openid. not_affected \u2014 Spring Security 5.1.5.RELEASE does not contain the One-Time Token (OTT) authentication feature. The vulnerable component JdbcOneTimeTokenService was introduced in version 6.3.x, several major versions after 5.1.5. The target codebase does not process one-time authentication tokens and therefore cannot be affected by the TOCTOU race condition described in CVE-2026-22751.", "justification": "code_not_present" } }, { "id": "CVE-2026-22754", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:569e56fb-dc76-5a21-b568-df4a8a63cea9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-openid. Spring Security 5.1.5.RELEASE is not affected by CVE-2026-22754. The vulnerability exists in version 7.0.0-7.0.4 due to a builder pattern bug in PathPatternRequestMatcherFactoryBean where the basePath() return value is not captured, and HttpSecurityConfiguration doesn't use bean-provided builders. Version 5.1.5 uses a completely different architecture (MvcRequestMatcher with property setters instead of PathPatternRequestMatcher with builders), and the servlet-path feature has worked correctly since its introduction in Spring Security 4.1 (2016).", "justification": "code_not_present" } }, { "id": "CVE-2026-41706", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:711dc5e7-d3e3-54c7-be2f-5854fc0bdbc5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41706 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-openid. not_affected \u2014 Spring Security version 5.1.5.RELEASE is not affected by CVE-2026-41706. The vulnerable classes (CookieRequestCache and CookieServerRequestCache) that store pre-authentication redirect URLs in cookies do not exist in this version. These classes were introduced in version 5.4.0-RC1 (commit 9708a2d63f). Version 5.1.5 only has HttpSessionRequestCache (which stores requests in HTTP session, not coo...", "justification": "code_not_present" } }, { "id": "CVE-2026-47838", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2e2a4311-385b-5e7c-ba17-a43cc701fa81", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47838 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-openid." } }, { "id": "CVE-2026-47841", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a4d0660a-3628-5795-909a-767d14cad46f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47841 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-openid." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:67b82e07-62ee-53d5-aea2-954e16f5e264", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-openid." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:05f39093-50ef-5b24-ae65-fa80b7307e3f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-openid. not_affected \u2014 Spring Security 5.1.5.RELEASE does not contain the InetAddressMatchers utility class that is the subject of CVE-2026-59277. The vulnerability concerns the matchInternal() and matchExternal() builders of InetAddressMatchers failing to recognize 0.0.0.0 and :: as internal addresses. Exhaustive search confirms this class, its methods, and the org.springframework.security.util.matcher package do no...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.1.5.RELEASE-tuxcare.1" } ] }