{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:fc8dcaa5-ccb0-5ce4-8b32-297b7001669b", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-remoting", "purl": "pkg:maven/org.springframework.security/spring-security-remoting@5.7.7-tuxcare.3", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.7.7-tuxcare.3", "version": "5.7.7-tuxcare.3", "pedigree": { "ancestors": [ { "name": "spring-security-remoting", "purl": "pkg:maven/org.springframework.security/spring-security-remoting@5.7.7", "type": "library", "group": "org.springframework.security", "version": "5.7.7" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:1c915e11-95d2-5a27-8ff0-5bb29ee67347", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:6aecdc3b-da38-5b7e-9d05-895af07b7a1b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:06efbda9-e4e2-5fa0-b005-53f6a52c6785", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:0d9e0be4-05d4-5601-89b8-9be0a14d7527", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:02c7cc53-4fa7-560d-9a51-e027b75d1c80", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:df356949-3485-5b16-9232-3ab68e7aba36", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:c3b7010b-8b1a-5fe5-91a3-41a48c0b9d0a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:7376a23b-4cc4-5dac-a735-7be4bec5c708", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:9ef75b12-c799-5601-85a5-d8a0b77f0c70", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:ceb67372-84f0-5d19-af27-99f20ea1f6ad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:5eb2be0f-e789-5d01-80e1-1ba99d5d9f1a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:4ada2d7e-3c75-53a6-9677-8357b1e4cfa1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:95171080-6339-5858-bddc-e0f1229ad973", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:e58f7b21-4aac-5906-b381-33dbc2c7a985", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:bb0d8ee6-365f-5e7e-bf6d-8335aae646db", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:35892363-afac-5795-9e30-9c37f8719623", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:4791974b-6c23-53c9-9023-de956e5cdb86", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:ef19bbd4-ecfb-5b69-b1e1-bc8d8945fb2e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:8e0cd428-ecdf-596c-8e44-caec54e31a3e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:7c79b755-7106-5123-a5bd-abd60acc5f3c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:abb2c4c3-4cef-50e7-8192-bbe01ef02796", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:0a52d8b3-af10-54bc-8102-64a31192a640", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:035f6aea-1570-513a-90b0-3451301d54bf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22257 is fixed in version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:61cb12d9-2cb3-560f-a202-aebbd2276922", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:9c638f46-9719-575e-8c63-68ea9cfa370c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38827 is fixed in version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:83ac5c53-67bb-5e0e-a882-d78594eb90c3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:85f84fe4-c561-5bd1-8618-a4063b6bb0de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22228 is fixed in version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:aa5a1914-76da-558c-8006-9955120d9a13", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-remoting. not_affected \u2014 Spring Security 5.7.7 is not affected by CVE-2025-22234. This CVE is a secondary vulnerability introduced by the fix for CVE-2025-22228, which added a password length check to BCrypt that broke timing attack mitigation. The target version (5.7.7) never received the CVE-2025-22228 fix, and therefore does not contain the problematic code that causes CVE-2025-22234. The timing attack mitigation in...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:370743d9-e37d-5cd2-a259-6e84fea485d4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-remoting. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.7.7 does not contain that scanner, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:98edddb3-021c-5cef-b0b4-de7e2a41402f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41248 does not affect version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-remoting. Spring Security 5.7.7 has no generic-type annotation matching of its own: method security looks annotations up through Spring Framework's annotation utilities, so the CVE-2025-41248 code is not present. The equivalent issue in Spring Framework is tracked as CVE-2025-41249.", "justification": "code_not_present" } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:e648fc31-2b3b-5810-9f4c-5d09e89a6b72", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:2a138ad7-8c1f-5c6b-a1d3-b01cf38a94a1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-remoting. not_affected \u2014 Spring Security 5.7.7 is not affected by CVE-2026-22751 because the vulnerable component (JdbcOneTimeTokenService) does not exist in this version. The One-Time Token (OTT) authentication feature was introduced in Spring Security 6.4.0, and version 5.7.7 predates this feature entirely. Comprehensive searches across the codebase found no JdbcOneTimeTokenService class, no OneTimeToken-related code...", "justification": "code_not_present" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:190b09b4-6945-5b00-8fe5-908e768700ca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:29763888-3142-5afc-b2a2-80636b3e0dd2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-remoting." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:e173dd38-188a-5667-92a3-53bff4644516", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-remoting. not_affected \u2014 Spring Security 5.7.7 is not affected by CVE-2026-59277. The vulnerable component, the InetAddressMatchers utility class with matchInternal()/matchExternal() builders for classifying IP addresses as internal or external networks, does not exist in this version. The CVE describes a misclassification vulnerability where 0.0.0.0 and :: are incorrectly treated as external addresses. However, versio...", "justification": "code_not_reachable" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-remoting@5.7.7-tuxcare.3" } ] }