{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:1fb94c7e-1881-5e77-b3fd-55b591211c0a", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-aop", "purl": "pkg:maven/org.springframework/spring-aop@6.1.4-tuxcare.8", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-aop@6.1.4-tuxcare.8", "version": "6.1.4-tuxcare.8", "pedigree": { "ancestors": [ { "name": "spring-aop", "purl": "pkg:maven/org.springframework/spring-aop@6.1.4", "type": "library", "group": "org.springframework", "version": "6.1.4" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:12257508-898f-5eb4-afed-b0feebbd6f10", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 6.1.4-tuxcare.8 of org.springframework:spring-aop." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:ee45e9af-9618-551b-ba28-ae79cb4d2f76", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.1.4-tuxcare.8 of org.springframework:spring-aop." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:e20babdb-3a33-51ed-bcbb-cb86011f5bf4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.1.4-tuxcare.8 of org.springframework:spring-aop." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:9f3d287c-a17a-5328-baad-ce35f2b989e2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.1.4-tuxcare.8 of org.springframework:spring-aop." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:e377eb22-5a24-570b-a5c5-60af4cdc858a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.1.4-tuxcare.8 of org.springframework:spring-aop." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:2848571c-de11-5acb-bc52-86a7c096592a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.1.4-tuxcare.8 of org.springframework:spring-aop." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:ea1ad64a-b06b-5c25-9c3f-239d93c8140c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.1.4-tuxcare.8 of org.springframework:spring-aop." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:c20fcb0d-552c-5365-a770-0fc632c88f90", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.1.4-tuxcare.8 of org.springframework:spring-aop." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:f9bf3595-7be4-53a9-a374-68562e29364d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.1.4-tuxcare.8 of org.springframework:spring-aop." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:ca0e596c-8570-5815-aed2-7cf25d31f488", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.1.4-tuxcare.8 of org.springframework:spring-aop. not_affected \u2014 Spring Framework 6.1.4 is not affected by CVE-2018-1257. The vulnerability (DoS via malicious STOMP selector header causing regex/expression parsing exhaustion) was fixed in upstream Spring Framework 4.3.17 and 5.0.6 (April 2018). The fix - a null-check that skips selector expression parsing when the feature is disabled - is present in version 6.1.4. Additionally, as of Spring Framework 6.1, th...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:824791b4-66f3-5e1a-89c7-e0e69657ddb4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.1.4-tuxcare.8 of org.springframework:spring-aop." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:763764e6-de0e-59a4-869c-2883b32decb7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.1.4-tuxcare.8 of org.springframework:spring-aop." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:b182306e-fe12-5e58-836e-1f4dfd59fdc9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.1.4-tuxcare.8 of org.springframework:spring-aop." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:f17e5264-f8b6-5946-9d92-0a2801989b8c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.1.4-tuxcare.8 of org.springframework:spring-aop." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:214619d3-9026-527a-bb50-055bcbf6f95a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.1.4-tuxcare.8 of org.springframework:spring-aop." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:41925345-6cbc-5684-8980-34f0a05d12a7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.1.4-tuxcare.8 of org.springframework:spring-aop." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:c2a7c42f-3b67-56cd-8c1a-e006cdfec366", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.1.4-tuxcare.8 of org.springframework:spring-aop. Spring Framework 6.1.4 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:07566ea8-a834-53fd-bf8c-a52a4cf6ec7a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.1.4-tuxcare.8 of org.springframework:spring-aop. not_affected \u2014 Spring Framework 6.1.4 is not affected by CVE-2022-22970. The fix was already present in the upstream Spring Framework 6.1.4 release that TuxCare onboarded. The vulnerability (DoS via data binding to dangerous read-only properties like AutoCloseable types and URL.content) was addressed in upstream commit 83186b689f11f5e6efe7ccc08fdeb92f66fcd583 by Juergen Hoeller on May 11, 2022, well before ve...", "justification": "code_not_present" } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:f70a0f38-4942-50ee-b9c0-9e3248c1c401", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.1.4-tuxcare.8 of org.springframework:spring-aop." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:a755e6e0-d8de-5f98-8a8a-07d7736e2bd2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.1.4-tuxcare.8 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:31592e44-0d0d-54e3-b8d9-d4ef2c85fd8b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.1.4-tuxcare.8 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:08b4fa9a-3789-51a0-b7ca-a0369050ea2b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.1.4-tuxcare.8 of org.springframework:spring-aop." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.1.4-tuxcare.8" } ] }