{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:51aca889-4558-5e21-92cf-85141acf6090", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-remoting", "purl": "pkg:maven/org.springframework.security/spring-security-remoting@3.2.8.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-remoting@3.2.8.RELEASE-tuxcare.1", "version": "3.2.8.RELEASE-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-security-remoting", "purl": "pkg:maven/org.springframework.security/spring-security-remoting@3.2.8.RELEASE", "type": "library", "group": "org.springframework.security", "version": "3.2.8.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:26d12caa-b874-59cf-8210-a473f2a4cb34", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9ee240ae-1b0e-5d73-8112-f03b4d96c5a0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:cee79a05-c913-5e6c-a706-705a1bb4a595", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a59a0c96-1d46-5475-9920-128783230680", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9114f871-1049-529e-ae15-8f1b2abc5555", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ddecca44-bc1b-587f-ae03-34b7a0459795", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d1eac17e-177a-5c63-9753-cd14cd5394dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0382da7b-2afb-54c3-a908-56b7efc66478", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:70b8aa77-bbd2-56a4-864c-6395e76d6676", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f1a22233-43f3-58ae-a3c6-ac0f300e7632", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6325d2ee-d743-52de-b193-adad86f8b95f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ba78efd4-5d94-55ed-9f5e-6b068e56ecd3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:01b692eb-8c18-5068-bdcd-34d36ba6928f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-11272 is fixed in version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f62ff0ca-d933-5a25-b956-358189ec2865", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f4e1e4bb-5ddf-53bf-bba1-df9455b50771", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2ad33823-bf28-5032-8e3a-4be297465ea7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:482afe33-106d-5163-b3ad-93eb79fe18b5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f36bb9d0-836c-5fd0-95a4-f9c92f815046", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1bab4cf1-d429-5e5f-9c86-98e35894f054", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22978 is fixed in version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8a96cedb-d24a-5435-9571-fba6a9ecb83d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3d8490ae-64b3-5196-8480-07e3bbd9fe2b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:16a0a186-adca-5014-b5ba-b43fb4e81c35", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d11231b6-0066-5570-9505-59798af2fcea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22257 is fixed in version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e300b311-cdbd-5f7a-a4bd-8f3101dc6ab0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c1079b19-00eb-576e-b7e2-80b27683f0a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38827 is fixed in version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3cd18eae-1367-54e3-b86f-93bc27857fae", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22223 does not affect version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting. not_affected \u2014 Spring Security 3.2.8.RELEASE is not affected by CVE-2025-22223. The vulnerability targets the modern method security architecture (`@EnableMethodSecurity` + `UniqueSecurityAnnotationScanner`) introduced in Spring Security 5.6+. Spring Security 3.2.8 uses a fundamentally different architecture (`@EnableGlobalMethodSecurity` + `PrePostAnnotationSecurityMetadataSource`) and lacks both the vulnera...", "justification": "code_not_present" } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:99583784-989f-55e6-aa14-0bcf64353767", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting. not_affected \u2014 CVE-2025-22234 is not present in Spring Security 3.2.8.RELEASE. This CVE is a secondary vulnerability that only manifests when CVE-2025-22228 is present. CVE-2025-22228 introduced a 72-byte password length check in BCrypt that inadvertently broke timing attack mitigation in DaoAuthenticationProvider. The target version does not have CVE-2025-22228 applied (no 72-byte limit exists in BCrypt.java...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:358264d9-1c7f-5467-8c5e-922dae83b801", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 3.2.8.RELEASE does not contain that scanner, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:96c6342e-7312-56b6-8261-e71ae08579ae", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41248 does not affect version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting. CVE-2025-41248 affects the annotation lookup used by @EnableMethodSecurity. Spring Security 3.2.8.RELEASE predates @EnableMethodSecurity, which was added in 5.6, and has no such lookup, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:87272c5e-67c5-56c2-81f4-5f1296c8e5ee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0d1eda35-f01c-589d-b7d6-0e29d0f5113e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting. not_affected \u2014 Spring Security 3.2.8.RELEASE is not affected by CVE-2026-22751. The vulnerable JdbcOneTimeTokenService class and the entire one-time token authentication feature do not exist in this version. The one-time token (OTT) authentication feature was introduced in Spring Security 6.x (circa 2021-2022), while version 3.2.8.RELEASE dates from 2015. The target repository contains no code that processes ...", "justification": "code_not_present" } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:291b7c02-60f3-55db-b738-0cf1ef9e6954", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59276 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b9da9a20-d28d-53b4-9b25-7983b1cecc62", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting. not_affected \u2014 Spring Security 3.2.8.RELEASE is NOT AFFECTED by CVE-2026-59277. The vulnerability requires the InetAddressMatchers utility class with matchInternal()/matchExternal() methods for classifying IP addresses as internal vs external. This feature does not exist in version 3.2.8.RELEASE. The target only has IpAddressMatcher for basic subnet matching, with no internal/external classification capabilit...", "justification": "code_not_reachable" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@3.2.8.RELEASE-tuxcare.1" } ] }