{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:88865d4c-067f-57c3-9b49-2b3849362d7d", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-aop", "purl": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.5", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.5", "version": "3.1.1.RELEASE-tuxcare.5", "pedigree": { "ancestors": [ { "name": "spring-aop", "purl": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE", "type": "library", "group": "org.springframework", "version": "3.1.1.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:6a65871c-8c2c-5523-985c-2a8976c600aa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 3.1.1.RELEASE-tuxcare.5 of org.springframework:spring-aop." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:c50ca296-b608-5832-86f7-aed9393e5d68", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 3.1.1.RELEASE-tuxcare.5 of org.springframework:spring-aop." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:ef2723bf-ed05-5c3d-8ce0-cf84ee4492e6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 3.1.1.RELEASE-tuxcare.5 of org.springframework:spring-aop." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:81688abd-a4b5-563a-b9bf-edfadd7ea9ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2014-3578 is fixed in version 3.1.1.RELEASE-tuxcare.5 of org.springframework:spring-aop." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:a52eb7c3-9732-5c20-b662-a43d8fc91598", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 3.1.1.RELEASE-tuxcare.5 of org.springframework:spring-aop." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:e2792b63-cfd0-5a1e-9b82-5990bd2b0058", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2015-5211 is fixed in version 3.1.1.RELEASE-tuxcare.5 of org.springframework:spring-aop." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:475ec000-4ff3-5a2e-b976-4b69b7ebd049", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-5007 is fixed in version 3.1.1.RELEASE-tuxcare.5 of org.springframework:spring-aop." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:83dd969a-33e2-56f1-8e98-53ac2bf3a1dd", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2018-11040 is a false positive for org.springframework:spring-aop 3.1.1.RELEASE-tuxcare.5. direct vulnerability is in Spring Framework project - affected versions are 4.3.0-4.3.17 and 5.0.0-5.0.6, version 3.1.1.RELEASE is not in this range" } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:73123d1d-d322-5964-84ae-8c6ea6ddf358", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 3.1.1.RELEASE-tuxcare.5 of org.springframework:spring-aop." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:cb3e8d3a-1038-5b3a-8554-fa86cbf2a476", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2018-1257 is a false positive for org.springframework:spring-aop 3.1.1.RELEASE-tuxcare.5. direct vulnerability is in Spring Framework project - affected versions are spring-messaging 4.3.0-4.3.16 and 5.0.0-5.0.5 (spring-messaging module does not exist before 4.0), version 3.1.1.RELEASE is not in this range" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:37b5b034-7ef1-5824-95fb-faa5524742e6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 3.1.1.RELEASE-tuxcare.5 of org.springframework:spring-aop." } }, { "id": "CVE-2018-1270", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:27918d71-cc66-573e-992c-f5a292f7dce4", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2018-1270 is a false positive for org.springframework:spring-aop 3.1.1.RELEASE-tuxcare.5. direct vulnerability is in Spring Framework project - affected versions are spring-messaging 4.3.0-4.3.15 and 5.0.0-5.0.4 (spring-messaging module does not exist before 4.0), version 3.1.1.RELEASE is not in this range" } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:8b7cd727-41f1-51d5-8519-60f95481c843", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 3.1.1.RELEASE-tuxcare.5 of org.springframework:spring-aop." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:ff3722a8-5c16-56aa-911d-96f8eada68fb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 3.1.1.RELEASE-tuxcare.5 of org.springframework:spring-aop." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:ef718d91-dcdf-52c5-a1c2-e3913dd0cee2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 3.1.1.RELEASE-tuxcare.5 of org.springframework:spring-aop." } }, { "id": "CVE-2020-5421", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:123ff3c2-fe25-5da6-8123-3333bf998d69", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5421 does not affect version 3.1.1.RELEASE-tuxcare.5 of org.springframework:spring-aop. not_affected \u2014 Spring Framework 3.1.1.RELEASE is NOT AFFECTED by CVE-2020-5421. The target version lacks the vulnerable code pattern (removeJsessionid() method) that existed in Spring 5.x versions. The existing RFD protection (from CVE-2015-5211 fix, commit 4a08cd41d9) correctly validates jsessionid path parameters and blocks dangerous file extensions at runtime. TuxCare backported CVE-2020-5421 to Spring 5.x...", "justification": "protected_at_runtime" } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:5bc723fd-3061-51ea-a99e-d911ef22a477", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22060 is fixed in version 3.1.1.RELEASE-tuxcare.5 of org.springframework:spring-aop." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:4d2ee778-89bf-5f97-828f-b422544284f9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 3.1.1.RELEASE-tuxcare.5 of org.springframework:spring-aop." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:32b67570-cf49-5c5e-a919-7b0cfb922b8d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 3.1.1.RELEASE-tuxcare.5 of org.springframework:spring-aop." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:ec8f5e6c-cd00-501c-ae8d-38cf54ff0801", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 3.1.1.RELEASE-tuxcare.5 of org.springframework:spring-aop." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:198e58d7-2ca7-5de0-8dfd-629d9f6e6fdc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 3.1.1.RELEASE-tuxcare.5 of org.springframework:spring-aop." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:0d9e71e4-42ff-5238-9d56-334129321d4e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 3.1.1.RELEASE-tuxcare.5 of org.springframework:spring-aop." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:6219608b-a1dd-57c5-a27c-e1c5ad864cee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 3.1.1.RELEASE-tuxcare.5 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:b24cfa77-6628-5552-ba37-b16ecd46519c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22740 does not affect version 3.1.1.RELEASE-tuxcare.5 of org.springframework:spring-aop. CVE-2026-22740 is a WebFlux-specific vulnerability (reactive multipart temp-file cleanup in org.springframework.http.codec.multipart.MultipartHttpMessageReader / PartGenerator). Spring Framework 3.1.1.RELEASE predates WebFlux entirely - the org.springframework.http.codec package does not exist in this version, and there is no reactive multipart code path. Per NVD, affected versions are 5.3.x, 6.1.x, 6.2.x, 7.0.x only; Spring 3.x is not in the affected range.", "justification": "code_not_present" } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:6c7f0eda-ccd2-5482-8fa6-febf1a4b32f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 3.1.1.RELEASE-tuxcare.5 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:5ee2f019-e6bd-57d5-987b-9217a51dcce8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 3.1.1.RELEASE-tuxcare.5 of org.springframework:spring-aop." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.5" } ] }