{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:94bc27a9-86bf-5f7d-95ec-e5b23e7b43cc", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-aop", "purl": "pkg:maven/org.springframework/spring-aop@6.0.23-tuxcare.10", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-aop@6.0.23-tuxcare.10", "version": "6.0.23-tuxcare.10", "pedigree": { "ancestors": [ { "name": "spring-aop", "purl": "pkg:maven/org.springframework/spring-aop@6.0.23", "type": "library", "group": "org.springframework", "version": "6.0.23" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:a12bd71c-4dda-525a-9d0b-6350fc0c2d02", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 6.0.23-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:1fb35328-786f-5fef-b898-58e353a04e51", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.0.23-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:e777f6c4-4663-5f1f-ad41-834b680c04ef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.0.23-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:8dbab0bc-a6e8-55f6-a386-499197ecb77e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.0.23-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:63fca528-a240-5c01-8631-4867c3e63188", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.0.23-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:bf008c39-f0e6-5a9a-84f4-84a82562d416", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.0.23-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:9ebdbf17-8b38-596a-9c03-31625e5a6bf3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.0.23-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:0fe3433e-96ea-5b66-bf4b-908bf55542f3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.0.23-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:ad1f7aa9-0eac-58aa-a5a4-bd4c37fd8ad8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.0.23-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:68f36c9c-e692-56be-808b-b17da062f3ff", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.0.23-tuxcare.10 of org.springframework:spring-aop. not_affected \u2014 CVE-2018-1257 affects Spring Framework versions with unconditional STOMP selector header parsing vulnerable to ReDoS. The target (6.0.23) contains the upstream fix from commit ff2228fdaf by rstoyanchev@pivotal.io that adds the ability to disable selector parsing via setSelectorHeaderName(null) and guards parsing with a null check. This fix was already present in the upstream Spring Framework 6....", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:7710d6d7-d83b-5ec4-9599-2e0d851a99f3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.0.23-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:1fe014af-d136-58db-a932-bb60579203cc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.0.23-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:090884da-9559-5a85-b944-033cfdabddcb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.0.23-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:702c0a49-15da-584a-9723-7203c90916d9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.0.23-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:cfe14da7-cd14-5a46-8a78-c41047495da7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.0.23-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:064f3054-5609-5c4d-9544-4850e89382ea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.0.23-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:1a72356e-f461-5b6b-aee3-568469b9f8f0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.0.23-tuxcare.10 of org.springframework:spring-aop. Spring Framework 6.0.23 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:f53bb093-cc64-5153-9526-acfbca6441b1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.0.23-tuxcare.10 of org.springframework:spring-aop. not_affected \u2014 CVE-2022-22970 is NOT present in Spring Framework 6.0.23. The vulnerability allowed DoS through resource exhaustion when data binding MultipartFile/Part objects, caused by introspection of read-only properties with dangerous types (AutoCloseable, ClassLoader). The upstream fix was already included in the 6.0.23 release, introduced by Juergen Hoeller in commit 83186b689f11f5e6efe7ccc08fdeb92f66f...", "justification": "code_not_present" } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:9c398f81-391f-5ddf-8f28-de55ac4779a4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.0.23-tuxcare.10 of org.springframework:spring-aop." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:fc7e7ffa-5e58-5c70-934a-9c296df32d2f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 6.0.23-tuxcare.10 of org.springframework:spring-aop, and is fixed in 6.0.23-tuxcare.11." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:085a2dc0-751c-5e76-9bba-be196db37bae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 6.0.23-tuxcare.10 of org.springframework:spring-aop, and is fixed in 6.0.23-tuxcare.11." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:92a7a69c-be31-5363-8ffb-fb3337708841", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.23-tuxcare.10 of org.springframework:spring-aop." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.23-tuxcare.10" } ] }