{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3ada6409-067d-53bc-9ffc-1610a0930b59", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.2", "version": "4.3.20.RELEASE-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE", "type": "library", "group": "org.springframework", "version": "4.3.20.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:08f58964-932b-5bba-9d2a-4c5abdbc8c93", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:93a3bae1-589b-5895-9807-5260a3ef2aad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2c333d53-9a0d-5695-a38b-8d2e4771466a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9b1c5451-4fba-5e95-b857-2ef4480316ba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:89d6e6f1-a45f-5644-8de5-3016c1a8e6aa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:985ad226-79b0-5226-8b83-805a58d29410", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:86b82419-dc75-5685-8031-bcc5402590e4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f85a1909-675f-577d-bf2c-23a14b62aa88", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:97922bf0-0d4c-5a42-a8a6-c187c428e5fa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:936adc14-b0b1-5158-bbd8-b2dee5392dca", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-context-support. not_affected \u2014 Target version 4.3.20.RELEASE is not affected by CVE-2018-1257. The vulnerability (regex DoS via malicious SpEL expressions in STOMP selector headers) was fixed by upstream Spring Framework in version 4.3.17 through two defensive measures: (1) switching from StandardEvaluationContext to SimpleEvaluationContext to restrict expression capabilities, and (2) adding configuration support to disable ...", "justification": "protected_at_runtime" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0a402cf1-7bf5-5140-8a6e-a144d389daa4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b0a36037-3e20-5042-bca7-e8930ab52c26", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:628e8e5c-6865-5a62-8d3e-6dc34324c2c8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:788246c4-8ea9-5ab3-95d3-9c12d75efc0b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a93601cb-1817-5e9c-a83e-bd8eab1d864c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f3aae3f3-f3c5-513f-86b2-7d3392fa55c4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:82c24466-537c-52ec-81ac-0b5a81d1c00a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0b85961b-b7b4-5d6a-96f5-af7fe46c9422", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ab5e7c71-15f0-5080-91ab-5ba73eea3f5c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:378c7c5c-a8bb-5b1e-a9bd-c18679a9f506", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7600dbbf-2399-551c-bc0e-216e60194d8c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1b02634e-262f-5e1b-8fb4-b89c8a948cc3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:09174769-5e48-5881-8f42-9580c6e14759", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9eb829a3-e2ad-5890-8480-a194d09fab29", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:58d0fdbc-e3f5-5906-8a27-cbede4fcd178", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-context-support. not_affected \u2014 Version 4.3.20.RELEASE (released October 2018) predates CVE-2024-38820 (2024) and its prerequisite CVE-2022-22968 (2022). The target uses case-sensitive pattern matching in DataBinder with no toLowerCase() calls. CVE-2024-38820 specifically addresses \"String.toLowerCase() has some Locale dependent exceptions\" - this vulnerable code pattern is not present in the target. The target was released 4...", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e55aa651-c2c5-57fb-ae9c-24ab3abb6fd2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:462a58eb-ae8e-5ad5-b418-1bdd056938bd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2e213364-8d0a-5c55-acad-2eb7b042b2ac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1e0e335b-1a0f-55e6-9721-9d3d32a3d3a1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7138b067-b63e-5d3d-ad9e-ccc829a181c8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:fd67dde7-568c-5d9a-87b4-e44d8dc32471", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7a5a5dbe-785e-517e-8a7e-29bcd4bf23ac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:573aab76-ddbd-5764-8220-bf09cb912f77", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6d8e955d-5c79-5c63-883c-3b90d1a8ad2b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:fd58ece3-a156-592e-b35a-f2cf5fe05218", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4047be24-9b66-591e-aa1e-c354d6c6bdf9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context-support@4.3.20.RELEASE-tuxcare.2" } ] }