{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8d8b88eb-2ecb-5d13-9173-2b209eae2e46", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-remoting", "purl": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.2", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.2", "version": "5.1.6.RELEASE-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-security-remoting", "purl": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE", "type": "library", "group": "org.springframework.security", "version": "5.1.6.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:24a2a679-2cec-596b-b5a4-58ada97e4c9c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9c301a90-a0d6-5d54-9215-0e22c6a209b3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8ffb14c3-5481-5c4f-8de9-b6ad7c9c52eb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5bb1a9e2-a616-5b59-af38-e242626ff285", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b3ec9d30-1775-5016-aea7-a60ac228b97a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:51abae37-b318-5be5-83aa-01196827e511", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4a2f4fd7-7be7-5616-97b7-83ac172bb900", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:cbce6bc2-e8ae-5d0a-a941-cc51aac0d4a8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:62a15b60-aa5c-54a6-8910-d3255271f433", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:000654bd-10dc-5c0c-871a-6cc52a068249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5e3dcad9-2d7d-5a99-ae51-68ec66793582", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2fbd11f5-e255-5d70-8040-40e5fa8afaf5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:cef5e1a5-5d59-5fd0-a55a-cb6798c95c63", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:798a1f9e-ceda-53a0-9c40-87cedaf8d510", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:786594b4-c1eb-5243-bdde-7ffceb748bf2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5312eb33-2c8b-5f4c-93bd-b0c4e0a351fc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0cb5eb5b-a4a2-5bda-b7e6-3a918854ea52", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b14f196a-b72b-527e-aefe-3a1cc39a8cd1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:fa753a55-0ea5-55e9-9ce2-72237ed468d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22978 is fixed in version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b696528b-c695-5e60-8369-8227ecb89122", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a916a222-4bfb-54ed-b07d-7e3e884f13b6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a599c44f-c0a3-598f-aa69-cc109860f7df", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b7db0622-e4b4-52b4-b4b2-f81d22fb2b92", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22257 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:55433f83-bf3b-5a69-b404-52a1be28f733", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:604e4bd7-4457-53c9-a4fc-b7d4be84f48f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38827 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:52c00400-4265-5af5-98f6-6d62bb130933", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22223 does not affect version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-remoting. not_affected \u2014 Spring Security 5.1.6.RELEASE does not contain the vulnerable code. CVE-2025-22223 specifically affects applications using @EnableMethodSecurity (introduced in Spring Security 5.6+), which resolves method security annotations via UniqueSecurityAnnotationScanner. Version 5.1.6 uses the older @EnableGlobalMethodSecurity API with PrePostAnnotationSecurityMetadataSource, a completely different impl...", "justification": "code_not_present" } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a9eaa1c8-d45c-58a5-9b04-3928ada39868", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-remoting. not_affected \u2014 The target spring-security 5.1.6.RELEASE is NOT affected by CVE-2025-22234. This CVE addresses a timing attack vulnerability that was inadvertently introduced by the CVE-2025-22228 fix. However, 5.1.6.RELEASE never received the CVE-2025-22228 backport, so the vulnerable code pattern (unconditional 72-byte password length check in BCrypt.hashpw that breaks DaoAuthenticationProvider's timing atta...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7e25e0c4-8722-5cdb-bd57-7c92bd58b2d5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-remoting. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.1.6.RELEASE does not contain that scanner, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c7fc05c2-d15c-50f4-a12f-0a598fa41299", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41248 does not affect version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-remoting. CVE-2025-41248 affects the annotation lookup used by @EnableMethodSecurity. Spring Security 5.1.6.RELEASE predates @EnableMethodSecurity, which was added in 5.6, and has no such lookup, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:788d6077-6bc0-5dce-9d20-d9522acc1549", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:65c9ade1-929e-50da-a37b-ee185a46b220", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-remoting. not_affected \u2014 Spring Security 5.1.6.RELEASE-tuxcare.2 is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService and the entire One-Time Token authentication feature) was introduced in Spring Security 6.4.0-M4 (July 2024), long after the 5.1.6 release. The target version does not contain the vulnerable code, cannot process one-time token authentication requests, and lacks the authen...", "justification": "code_not_present" } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b3f5bdd7-cc43-5f0d-841b-e0f933f53a1a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:37dd8da8-bdfa-58a4-8e3e-c53fb8f645f7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-remoting. not_affected \u2014 Spring Security 5.1.6.RELEASE-tuxcare.2 is not affected by CVE-2026-59277. The vulnerable component InetAddressMatchers (with matchInternal() and matchExternal() methods) does not exist in this version. The class was introduced in later versions of Spring Security. Version 5.1.6 only contains IpAddressMatcher, a CIDR-based subnet matcher without internal/external IP classification capabilities,...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.1.6.RELEASE-tuxcare.2" } ] }