{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:5c6f1402-18fe-5faa-8836-a8ce64614cda", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-aop", "purl": "pkg:maven/org.springframework/spring-aop@6.0.23-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-aop@6.0.23-tuxcare.11", "version": "6.0.23-tuxcare.11", "pedigree": { "ancestors": [ { "name": "spring-aop", "purl": "pkg:maven/org.springframework/spring-aop@6.0.23", "type": "library", "group": "org.springframework", "version": "6.0.23" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:970ad42e-d6a5-5c32-a830-2d94c86ad697", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 6.0.23-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:cdcaab1c-2599-5ab5-9887-9b43abf91f21", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.0.23-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:1d42628c-e475-5121-85b0-ab8005b8a90d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.0.23-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:2076de36-7889-5822-936a-d85cf8e09c44", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.0.23-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:452140d2-04e9-5a5e-87f9-ea3af92f0666", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.0.23-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:54473473-7008-52f3-ae27-49de17b696a0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.0.23-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:06e0b2d9-26ba-5187-8d59-9b04a960096b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.0.23-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:ac75c35b-970f-5117-bcdb-2fb6b9e6a1ab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.0.23-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:dc2b7691-181d-5114-9eaf-297969327453", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.0.23-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:86c19299-99c0-594d-ac25-02598cc37aa0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.0.23-tuxcare.11 of org.springframework:spring-aop. not_affected \u2014 CVE-2018-1257 affects Spring Framework versions with unconditional STOMP selector header parsing vulnerable to ReDoS. The target (6.0.23) contains the upstream fix from commit ff2228fdaf by rstoyanchev@pivotal.io that adds the ability to disable selector parsing via setSelectorHeaderName(null) and guards parsing with a null check. This fix was already present in the upstream Spring Framework 6....", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:ad7f3e3c-c02d-5935-baa8-5204692736f0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.0.23-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:eb2877e9-a995-5a4a-b7e7-d9fdc4fbc1c8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.0.23-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:bcab142c-a3d3-5c7f-8c71-50cbd3a36fa6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.0.23-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:c01dd17c-be88-527e-9a00-3cf5953b7a44", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.0.23-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:fcf76096-056b-5e4f-be40-c2e856ff0254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.0.23-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:c32013ed-efd9-5999-9910-3612c68cd375", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.0.23-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:7ef10469-cd30-52cb-ae1e-d3ec674c4345", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.0.23-tuxcare.11 of org.springframework:spring-aop. Spring Framework 6.0.23 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:60f7cc5d-8e78-5b5d-aa89-4763989e7910", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.0.23-tuxcare.11 of org.springframework:spring-aop. not_affected \u2014 CVE-2022-22970 is NOT present in Spring Framework 6.0.23. The vulnerability allowed DoS through resource exhaustion when data binding MultipartFile/Part objects, caused by introspection of read-only properties with dangerous types (AutoCloseable, ClassLoader). The upstream fix was already included in the 6.0.23 release, introduced by Juergen Hoeller in commit 83186b689f11f5e6efe7ccc08fdeb92f66f...", "justification": "code_not_present" } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:d0ff76bc-8f94-564b-bf23-23321efe32b7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.0.23-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:00acacfe-0173-5944-9af4-493e9ce7e204", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:bf648392-3df4-569c-86b3-8d8852bcdac0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:58837ae1-c648-558d-92fd-19007f06b76b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-aop." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.0.23-tuxcare.11" } ] }