{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:0669ad27-cd4d-5d85-8491-f9bd4b3db3ad", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-aop", "purl": "pkg:maven/org.springframework/spring-aop@6.2.3-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-aop@6.2.3-tuxcare.2", "version": "6.2.3-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-aop", "purl": "pkg:maven/org.springframework/spring-aop@6.2.3", "type": "library", "group": "org.springframework", "version": "6.2.3" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:0eca70bf-74ea-5f1b-8900-f78c74c1e295", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 6.2.3-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:8096a157-ae02-5f10-bd38-c2064e2e9883", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.2.3-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:23b11a53-2769-5d10-8ee1-b6b18b95f883", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.2.3-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:c34d2cb6-09da-55e9-8975-5d1ea3b6349c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.2.3-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:f4c037cf-2cfd-5d18-ab55-9370858fa741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.2.3-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:23ec7034-11d0-517e-bb0b-1b9d6e5d0a7b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.2.3-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:bba431d2-0c1d-51e4-8779-58208dd7a62a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.2.3-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:5ec36c54-abbd-5b39-bafa-2b00722a0d10", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.2.3-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:5c9a98bd-c1bc-5a83-91b7-6a2b8e572841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.2.3-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:794165d0-7c5f-5c45-a658-5a065abfe634", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.2.3-tuxcare.2 of org.springframework:spring-aop. not_affected \u2014 CVE-2018-1257 does not affect Spring Framework 6.2.3. The vulnerability involved unchecked parsing of attacker-controlled Spring EL expressions from STOMP subscription selector headers, leading to potential DoS through regex/expression complexity. The upstream fix (commit ff2228fdaf, April 2018) added the ability to disable selector header support via setSelectorHeaderName(null). A subsequent h...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:bafa35aa-a6bf-598c-a6d9-15e95b5b2818", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.2.3-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:d061fc1f-c71d-547a-be97-7f749f88793a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.2.3-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:c131dbc8-0f17-5224-bfdc-ec357c4ddc52", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.2.3-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:9ee2bc85-8747-543c-b1d8-e86a7518b40b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.2.3-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:517c195d-75d7-54ef-bdd2-9f75302d69b6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.2.3-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:7974a078-fde0-5b4e-bec4-1a7d779ce324", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.2.3-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:4507109b-5fba-5244-aa92-e0aab22ef0c4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.2.3-tuxcare.2 of org.springframework:spring-aop. Spring Framework 6.2.3 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:06bf2809-c0a8-55a1-b1e3-4c01a66eda19", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.2.3-tuxcare.2 of org.springframework:spring-aop. not_affected \u2014 Spring Framework 6.2.3 is not affected by CVE-2022-22970. The vulnerability was fixed in upstream versions 5.3.20+ and 5.2.22+ (released May 2022). Version 6.2.3 is significantly newer and includes the complete fix in the upstream release. The fix filters dangerous read-only properties (AutoCloseable, ClassLoader, ProtectionDomain) and specifically blocks URL.content from JavaBeans introspectio...", "justification": "code_not_present" } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:e758f48f-b311-594e-a757-e90d6a9fcce5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.2.3-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:46d81779-0cb1-5e0d-a9b5-e915a9e0f17c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.2.3-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:b2447229-6e68-5af1-8aaa-a292a287a469", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 6.2.3-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:e022e667-7312-593a-ba4b-1024113a0019", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.2.3-tuxcare.2 of org.springframework:spring-aop." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-aop@6.2.3-tuxcare.2" } ] }