{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c1d6fb64-c8bb-5e1c-bf0b-e1ff7fee0272", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-aop", "purl": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.6", "version": "3.1.1.RELEASE-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-aop", "purl": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE", "type": "library", "group": "org.springframework", "version": "3.1.1.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:74acc26c-dee2-59f5-b8be-48b2ceb22732", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:a93e6edd-a5f3-53c2-bd2e-a9a1afc92a7e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:6b67813b-4843-52a8-b158-f4d350f44032", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:524a6840-d821-5cc3-943b-36d9b38cc7eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2014-3578 is fixed in version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:1e565932-c5e0-568a-8c12-39516ebfb99a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:c18e9eb8-2281-57be-9e6d-f8efb0643d48", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2015-5211 is fixed in version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:8de6dda4-f1d5-57be-af0c-16f91921d54d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-5007 is fixed in version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:aaea1586-8ec8-5faf-ac9c-66cfff55eb6c", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2018-11040 is a false positive for org.springframework:spring-aop 3.1.1.RELEASE-tuxcare.6. direct vulnerability is in Spring Framework project - affected versions are 4.3.0-4.3.17 and 5.0.0-5.0.6, version 3.1.1.RELEASE is not in this range" } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:0614abdf-0af4-52b4-b323-697d9d3062df", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:9483a3e0-693d-5873-b5d2-084ee4805ea8", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2018-1257 is a false positive for org.springframework:spring-aop 3.1.1.RELEASE-tuxcare.6. direct vulnerability is in Spring Framework project - affected versions are spring-messaging 4.3.0-4.3.16 and 5.0.0-5.0.5 (spring-messaging module does not exist before 4.0), version 3.1.1.RELEASE is not in this range" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:8fc5037b-08b3-5488-b2d6-6e7c76fa95ea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2018-1270", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:d9a91005-8ce6-5857-81c4-1175ee725304", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2018-1270 is a false positive for org.springframework:spring-aop 3.1.1.RELEASE-tuxcare.6. direct vulnerability is in Spring Framework project - affected versions are spring-messaging 4.3.0-4.3.15 and 5.0.0-5.0.4 (spring-messaging module does not exist before 4.0), version 3.1.1.RELEASE is not in this range" } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:ea1040fc-0d5e-5917-81d6-a69bd5aa02e8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:6dc0a425-0ea0-5c4b-97ae-10aa2faf6163", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:be866770-23f0-5f8d-bbf6-ab70ffa4edd9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2020-5421", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:0cc2acc9-0c2b-5379-b3ce-738e454a60e0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5421 does not affect version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-aop. not_affected \u2014 Spring Framework 3.1.1.RELEASE is NOT AFFECTED by CVE-2020-5421. The target version lacks the vulnerable code pattern (removeJsessionid() method) that existed in Spring 5.x versions. The existing RFD protection (from CVE-2015-5211 fix, commit 4a08cd41d9) correctly validates jsessionid path parameters and blocks dangerous file extensions at runtime. TuxCare backported CVE-2020-5421 to Spring 5.x...", "justification": "protected_at_runtime" } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:481fdff8-4f98-5020-9c9f-1f57082222cc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22060 is fixed in version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:0e31c46a-81c8-5fbb-9c4b-d4cff34a2eb9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:ea4dad1d-2ff9-5cf6-8deb-086a709ca854", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:07d8ad93-19a9-5af2-91b8-c27bb39949a7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:61516721-51a5-51fd-a6a1-73038c313cd9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:a0eb6b0b-a042-56e4-857b-0b465dbfb1d7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:fea82355-4d2f-5de5-9dc6-63af963f8069", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:b976c305-1f8c-5ab5-bcf0-fc2e751a7ec3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22740 does not affect version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-aop. CVE-2026-22740 is a WebFlux-specific vulnerability (reactive multipart temp-file cleanup in org.springframework.http.codec.multipart.MultipartHttpMessageReader / PartGenerator). Spring Framework 3.1.1.RELEASE predates WebFlux entirely - the org.springframework.http.codec package does not exist in this version, and there is no reactive multipart code path. Per NVD, affected versions are 5.3.x, 6.1.x, 6.2.x, 7.0.x only; Spring 3.x is not in the affected range.", "justification": "code_not_present" } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:ee007561-0afc-5c6f-87a4-7f81042150de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:3f71af6b-af3c-5147-80e9-91babfbdee49", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-aop." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-aop@3.1.1.RELEASE-tuxcare.6" } ] }