{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:fe958b8a-dae9-515f-a482-7600e8c869e3", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-remoting", "purl": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1", "version": "5.1.6.RELEASE-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-security-remoting", "purl": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE", "type": "library", "group": "org.springframework.security", "version": "5.1.6.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:276d9ac5-beef-555d-94e4-35b6fe1eacdb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ce5ab580-0ee5-5aa8-aa52-5759aff8ed2f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7c93b8a0-aa3f-5c17-9e5e-711c78143711", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5454c53d-99f8-55c9-a272-18c04f0d5a4f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:fae08bd0-4076-5fa0-826c-84dcf2e4d2d4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ba0b2b34-3d7a-5fef-92d3-e4522928920d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:87127097-9462-561c-9d0a-3deb9c9aa8ab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:254382ba-a5dd-518a-adaf-6883b750557e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2118d3df-8ea4-575e-bae4-11469546267f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2bd18e75-3f49-5fe7-90fc-765a811e4a3c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b863290c-d981-59d1-a7af-6322dcf83ee6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8357c663-1f51-5e54-9ec4-a7f9f1b31bbb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a1688a16-d9a1-5b9d-933a-a0b90f525890", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:972ac912-9f98-51e6-8495-b5f92a9763c5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b0aaad04-4b89-5719-9ed9-51c21b03be24", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:348beeb6-9a00-52a3-b011-f763b958ea81", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d55187d9-c353-54ab-9542-8bb229bc4414", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f0f2818e-5100-5e7f-bd81-5fbdd2b4eeba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:bb6e74e5-38de-5bee-9ae3-23af625606a2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22978 is fixed in version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e3e33762-d785-5224-9fcc-c2f59c3b55b4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ed11b773-2c10-5c2a-b055-fcc7e5ad2cfd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2ac7641d-3abd-5be1-8aa3-324568c968f5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4c45f3b8-9a18-5fc8-8998-a8fb733e0c09", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22257 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5fae2667-f194-5082-b994-59464459acfd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:cf0661ca-91f9-5e85-b00e-adde43813446", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38827 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:987b9938-4aa3-5f58-8e52-9e0c64bed048", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22223 does not affect version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting. not_affected \u2014 Spring Security 5.1.6.RELEASE does not contain the vulnerable code. CVE-2025-22223 specifically affects applications using @EnableMethodSecurity (introduced in Spring Security 5.6+), which resolves method security annotations via UniqueSecurityAnnotationScanner. Version 5.1.6 uses the older @EnableGlobalMethodSecurity API with PrePostAnnotationSecurityMetadataSource, a completely different impl...", "justification": "code_not_present" } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:942b666f-2f35-50c7-a909-1862b6ea90fc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting. not_affected \u2014 The target spring-security 5.1.6.RELEASE is NOT affected by CVE-2025-22234. This CVE addresses a timing attack vulnerability that was inadvertently introduced by the CVE-2025-22228 fix. However, 5.1.6.RELEASE never received the CVE-2025-22228 backport, so the vulnerable code pattern (unconditional 72-byte password length check in BCrypt.hashpw that breaks DaoAuthenticationProvider's timing atta...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1a319d55-9461-5131-b2ef-2eea5685daa5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41232 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:728cacdc-e7a4-5ce4-9aa0-6187ae203506", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41248 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:41a0f0bd-f39d-56a8-87a2-c58d3ca39fda", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:dc91f493-12de-5aa3-a999-700bf7523513", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting. not_affected \u2014 Spring Security 5.1.6.RELEASE-tuxcare.2 is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService and the entire One-Time Token authentication feature) was introduced in Spring Security 6.4.0-M4 (July 2024), long after the 5.1.6 release. The target version does not contain the vulnerable code, cannot process one-time token authentication requests, and lacks the authen...", "justification": "code_not_present" } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:99a9cdb0-1c00-5ff7-8cb5-3222623a4a20", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:12c229a2-7ebe-5336-9550-38de5135de05", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-remoting. not_affected \u2014 Spring Security 5.1.6.RELEASE-tuxcare.2 is not affected by CVE-2026-59277. The vulnerable component InetAddressMatchers (with matchInternal() and matchExternal() methods) does not exist in this version. The class was introduced in later versions of Spring Security. Version 5.1.6 only contains IpAddressMatcher, a CIDR-based subnet matcher without internal/external IP classification capabilities,...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.1" } ] }