{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:4d92b42a-6a74-5fd7-bc6f-2cc7aae92f7e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@5.0.13.RELEASE-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context-support@5.0.13.RELEASE-tuxcare.6", "version": "5.0.13.RELEASE-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@5.0.13.RELEASE", "type": "library", "group": "org.springframework", "version": "5.0.13.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:b2647f53-79b3-5c47-bb80-eaa9c5c68945", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:3ec6c0c5-5e91-5a91-83ff-c9ad419b927a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:8e90998f-c3be-51f8-a062-b6d0af2dc778", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:e8c0d39f-2c21-5ff0-9cc3-5d8c1bb09345", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:4fb07532-4375-5612-94e8-76bec7375bf1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:ddc2ec7c-249c-5eb9-ba3a-6012644f0672", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:582c4a0a-5fd1-5965-beb4-f9e25e1081aa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:d623133a-7af6-5b43-ba68-6befcf2bd896", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:c1e71004-c098-5dc0-b30a-de426bf0ae5a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:7f4f37fa-8dfa-5461-bd29-523e9357d372", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1257 affects version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:e19e3b4a-d403-56b2-8f3c-1cd4ebc4f9bc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:36632aac-d878-5fd6-90d8-bf825262cf0f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:e35e512a-fe6a-59b7-9e87-93dfba4ca1bf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:d89a6ff8-bf39-5cb7-9562-d115c47c92e0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:9fd18d8b-f7d5-5abb-bdd6-4f0bf16ee3a5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:0ebd9f6f-8703-5a4f-9146-df484d44d925", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:dcbd8e84-ffea-5857-915f-028448869845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:2c918787-cbba-558f-bee3-4e54b70683a3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:f4de5191-c7cb-53c8-b6c7-b0c73ab64ba6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:96a08059-dc92-5af7-bf6e-c103d62c27da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:39cff385-08ad-5c66-b8cf-ba2e0c76db7e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:1cbe4097-6663-5867-9c57-d717588d4f50", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:2d654c5a-377a-513b-83f4-468384a80704", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:6975e627-ce3b-5abc-a655-9001ef8bcd57", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:121a26d8-be1c-5f80-8141-55c27b8b6a27", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-context-support. not_affected \u2014 Target version 5.0.13.RELEASE is not affected by CVE-2024-38820. The vulnerability requires locale-dependent toLowerCase() calls that were introduced by the CVE-2022-22968 fix. Version 5.0.13 predates CVE-2022-22968 and uses case-sensitive field matching without any case transformation, therefore the locale-dependent bypass mechanism described in CVE-2024-38820 cannot occur.", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:a68a50fc-076d-5f77-9f4c-7d95f9563a8b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:4848ce2d-91be-54f8-871e-f8d451cf682b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:717afd02-6d0b-5894-8d5a-b31d8f476522", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:1b728fe0-536b-57cc-974f-a3195bab1925", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:a901c0f0-a3a1-59be-b79a-e46b15fcbdee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:1369ff64-9994-5503-9586-2876eaa236a4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:c6922c7f-6a8d-5f54-941c-9fdb3b39d46e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:de44c1b4-6b53-54cb-a5da-014bd6fdbeb7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:8289ce31-e71a-5a5c-b8c2-33a3426f880d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:0323c679-66b1-5f8c-91aa-d9850a830e99", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.13.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:778f45c2-cba2-5e6d-beb2-34346c1d4a6e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-context-support." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.0.13.RELEASE-tuxcare.6" } ] }