{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6bad858f-595d-5828-8029-9c6be02b2815", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-remoting", "purl": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.5.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.5.RELEASE-tuxcare.1", "version": "5.1.5.RELEASE-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-security-remoting", "purl": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.5.RELEASE", "type": "library", "group": "org.springframework.security", "version": "5.1.5.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:765c4e70-a473-5665-9279-641354d5b38a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4c806374-4067-51c8-99c8-223ca58b631d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:bb8e5847-ed04-503b-9f42-6fc4e03ce84f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1f3865d6-3c1e-5bb6-889d-db607113f0ba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3d492786-bfdb-563f-94b7-c1bef6248dec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:542946d6-e77c-5c3e-ab1b-8ac3ceccb3f9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f4c5e20e-d141-5182-9503-ead3ba08fc24", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e0d4c8d6-c39b-506e-9337-fde36965c26f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d1e4cd7f-1a56-5e6d-90b0-00f44648ec6e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8a28cbb8-ba66-53de-bc04-e84625bf1180", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5820cae0-49a2-56a8-97ec-4bcb16f14013", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8dd1499d-d119-5236-914c-4746684dd070", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:64821413-a979-589b-97fd-47bbdfae6294", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1736218e-d18c-535b-a140-3ab24d42f9d2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-3795 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting. not_affected \u2014 The target repository (Spring Security 5.1.5.RELEASE-tuxcare.1) is NOT AFFECTED by CVE-2019-3795. The vulnerability involved insecure randomness when SecureRandomFactoryBean#setSeed was used to configure a SecureRandom instance - specifically, calling setSeed() before any random bytes were generated would cause the user-provided seed to REPLACE the entire internal RNG state rather than suppleme...", "justification": "code_not_present" } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ed07826c-bb17-59c4-9d46-640c0389b757", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:25327aff-7855-5c3a-bb51-31fd67682e4d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c38320ab-bc30-5ed8-94a8-8fb7c09b24b4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d108bebc-0c50-5d6a-bb67-f0c99a6380ca", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a97cc2e0-a12b-5e5f-8ef0-90a28a524be2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22978 is fixed in version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d98a8907-610b-5e6a-adb2-517915c15585", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:932f002a-b992-5d24-9bb7-c73ef258170d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:330403e5-6304-5772-8ee4-9c66cf9a97aa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e934253e-a329-5d7b-b386-18f7806ddee8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22257 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:eb5d754e-bd79-59e1-a8c0-430c1f6c20bb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:01864918-ec07-5cce-b104-34a30e2db899", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38827 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:491d2b72-71ed-5302-9225-b451dd049db9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22223 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting. not_affected \u2014 Spring Security 5.1.5.RELEASE is not affected by CVE-2025-22223. The vulnerability requires @EnableMethodSecurity and the UniqueSecurityAnnotationScanner class, both introduced in Spring Security 6.0.0. Version 5.1.5 uses @EnableGlobalMethodSecurity with PrePostAnnotationSecurityMetadataSource, which relies on Spring Framework's ClassUtils.getMostSpecificMethod() to correctly resolve annotation...", "justification": "code_not_present" } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5d47f941-f072-508b-8e35-4cbdb3fb47af", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting. not_affected \u2014 Target version 5.1.5.RELEASE is not affected by CVE-2025-22234. This CVE fixes a timing attack vulnerability introduced by CVE-2025-22228, which added an unconditional 72-byte password length check that broke timing attack mitigation in DaoAuthenticationProvider. The target does not have CVE-2025-22228 applied, therefore it cannot have the timing oracle vulnerability that CVE-2025-22234 address...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8e20d767-8213-5904-9f92-d76ba1add7a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41232 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f8073ed6-0ec5-57f0-aea7-111386901147", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41248 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:81c0b482-f583-5bcd-8400-0a932d9e0f23", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7f2d2969-6b86-52a6-a305-8f39ebc55ba9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting. not_affected \u2014 Spring Security 5.1.5.RELEASE does not contain the One-Time Token (OTT) authentication feature. The vulnerable component JdbcOneTimeTokenService was introduced in version 6.3.x, several major versions after 5.1.5. The target codebase does not process one-time authentication tokens and therefore cannot be affected by the TOCTOU race condition described in CVE-2026-22751.", "justification": "code_not_present" } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7fde1b59-0537-5d32-a900-e1af552a9525", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f1953a03-dff8-5c1a-82c8-8e5f8905d7d9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting. not_affected \u2014 Spring Security 5.1.5.RELEASE does not contain the InetAddressMatchers utility class that is the subject of CVE-2026-59277. The vulnerability concerns the matchInternal() and matchExternal() builders of InetAddressMatchers failing to recognize 0.0.0.0 and :: as internal addresses. Exhaustive search confirms this class, its methods, and the org.springframework.security.util.matcher package do no...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.5.RELEASE-tuxcare.1" } ] }