{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e7c0a04c-a769-582d-8dfb-4abcbfea151d", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.2", "version": "5.1.7.RELEASE-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE", "type": "library", "group": "org.springframework", "version": "5.1.7.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ce7daf26-a755-51aa-814e-5f266fd7444b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9fe3c2aa-ad1f-5d55-b799-8e01b27c88ca", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:df3d9558-2ec5-54cd-bb39-fb854ad2fd6b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:29c2e0a9-30b1-5c63-ae08-8518bf41e9ec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:089b206e-dcce-5e10-ba81-ce036930494b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9fd1aa90-22ad-5eac-874f-d7093a0f627d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e7420514-afd9-5875-afa9-72d760684b48", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:67fb74f7-1194-5f17-9527-39280fd22b94", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:cf61651e-f968-56a3-82f3-c35a3c4c990e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:af8c4583-6db6-5e76-8df0-29a383af1e92", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-context-support. not_affected \u2014 The target Spring Framework 5.1.7.RELEASE is NOT affected by CVE-2018-1257. The vulnerability involves a regex denial of service attack via malicious selector headers in STOMP subscription messages. The upstream vendor (Spring/Pivotal) fixed this vulnerability in commit ff2228fdaf (April 2018) by adding a null-check guard that prevents parsing of selector expressions when selector support is di...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c1113da2-eb6c-5a47-b4b9-8615d60e0cb3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:338010a9-5a97-54bf-8c5a-e8efc7679a3f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:026a8544-70bf-517b-bc69-5383134b8700", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7486381a-f1a1-5f6d-b641-b5562db5885e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f3711afa-e78e-51cc-a050-451a3b8ac6aa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2732c23c-e938-59df-aaa5-63ceaa732aed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a1de4e25-b89a-5d00-8c19-a798c8923696", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:11c7b111-7df7-57c3-bf7a-74ca2f9c7e28", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d3194d4a-f87b-582a-bfcf-3fc051c18b6a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:46d55e19-e5d3-560d-ab08-ef218cdac4cf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3c8a0b84-eff3-5923-a9ef-c1481c86d56b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:41e46d76-88ac-583a-8151-49cbe3a85331", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a23e3e36-5f25-5660-83ef-7a86fde03364", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8fbd451d-3538-59e2-8ce9-5a0b9efdfcde", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9470e2f9-cb41-5958-9b7d-88ec4ab0fd91", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-context-support. not_affected \u2014 The target (Spring Framework 5.1.7.RELEASE) is not affected by CVE-2024-38820. This CVE addresses a locale-dependent toLowerCase() vulnerability in DataBinder's disallowedFields checking that was introduced by the fix for CVE-2022-22968. Since 5.1.7.RELEASE (released in 2019) predates CVE-2022-22968 (from 2022), it does not contain the case-insensitive disallowedFields checking code that uses t...", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e70b5dd0-5d04-5e47-b031-b015dc505793", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3373605d-903f-5b5c-ba29-9fd77d6ce7cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:cadee452-cd4e-5f94-aee7-7a8f73cd74d2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:05652714-3382-5768-9ee1-e404d73c86e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:20ee901a-7058-53c8-bf6c-444f8b62a313", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4e3c4b88-acd0-5d60-ba6d-0d3c72b9f6a0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:fca2968d-0d33-5ce9-9eaf-82cbefddd423", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f1d500c6-d76f-5dde-b6b3-48ec05f8944d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4ccce3ac-4f7f-58b5-97cb-39f2b5c41f12", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2c988405-8bbf-54bf-80eb-2d2e1e53875a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0a39e2ca-5d34-54b2-b40b-16a1076d1d57", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.1.7.RELEASE-tuxcare.2" } ] }