{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8dd62062-fc50-5257-a121-b3a3f136983b", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.2", "version": "5.3.32-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@5.3.32", "type": "library", "group": "org.springframework", "version": "5.3.32" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:eb55d6d0-1b33-54e8-91bb-9e62582aa33b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 5.3.32-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:9532d6de-1ed1-5e8e-9e9f-2a44876f825a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 5.3.32-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:9c35c47e-b61c-50da-af78-1fe6731e2fff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.3.32-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:2f8f1b50-224c-545d-8a25-5c69bf521096", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 5.3.32-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:ab4abd27-484b-5c4f-b4e8-d23eb51aee7c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 5.3.32-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:a149741e-40f6-556f-ac19-1b0a99a57c07", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 5.3.32-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:af4aae3a-284b-5efd-bc7c-977b9d79e987", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.3.32-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:eb04d0cf-0938-5568-8466-8acb47c1b400", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 5.3.32-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:4bac7e4f-6beb-52ae-be66-612d40a24968", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.3.32-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:de1f81da-24c1-5dc4-bf0c-4a1fda2f2709", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 5.3.32-tuxcare.2 of org.springframework:spring-context-support. not_affected \u2014 The target Spring Framework 5.3.32 is NOT affected by CVE-2018-1257 (STOMP selector ReDoS vulnerability). The upstream vendor fix was already present in the 5.3.32 release that TuxCare onboarded. The fix adds a null-check guard around selector expression parsing in DefaultSubscriptionRegistry.getSelectorExpression() (lines 162-164), allowing the selector feature to be disabled entirely by setti...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:dec4a853-7912-559a-b804-910afc1bd40e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 5.3.32-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:7552fbe5-5fc1-5300-bebc-fbd6c86ea97a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 5.3.32-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:fd32f4b6-2240-5927-b3c7-c16702ff778f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 5.3.32-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:8e323591-0312-5ce9-ba74-a4cd7ddff27a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 5.3.32-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:c8ca5314-0039-5e18-828e-2b6875663c16", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.3.32-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:7638140b-bb64-5453-9c45-911e1b9fafdf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.3.32-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:066b0325-9902-583e-b88a-10ba47604ac8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 5.3.32-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:8ca1668d-af33-5e7f-8179-aa1860691daa", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 5.3.32-tuxcare.2 of org.springframework:spring-context-support. Spring Framework 5.3.32 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:d05d9b6b-f443-5596-8057-f1e94455e5a5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 5.3.32-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:282653ca-3a00-558a-9393-695c025f8c39", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 5.3.32-tuxcare.2 of org.springframework:spring-context-support. not_affected \u2014 CVE-2022-22970 fix was already present in the upstream Spring Framework 5.3.32 release. The vulnerability affects applications handling file uploads with data binding to MultipartFile/Part fields, allowing DoS through repeated access to expensive read-only property getters. The fix (commit 83186b689f, May 2022) filters AutoCloseable, ClassLoader, and ProtectionDomain read-only properties during...", "justification": "code_not_present" } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:0b5cc8a6-8035-5327-9d5c-9f47f333f714", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.3.32-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:cb04f5e3-eeda-5633-8dbc-ef1a6d18ae79", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.3.32-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:22939fd7-6eda-5f01-b2f9-3fd7fdfb8c3f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 5.3.32-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:eb339108-80b4-5631-93b4-a20408f2a265", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.3.32-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:782583e3-2905-5124-b592-6ffc896244fd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 5.3.32-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:59bbd46c-d4b1-5bb9-9ebf-a9843150ca4f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.3.32-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:922d405b-b92c-5e40-bc49-2b1893120229", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.3.32-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:7c1870d2-46ed-5193-9a20-5f916981ce29", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.32-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:65b3c54c-221e-5f4a-9695-832b7ff0c606", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.3.32-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:326ae81d-9e5c-5134-b850-df721c58f6b9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.3.32-tuxcare.2 of org.springframework:spring-context-support, and is fixed in 5.3.32-tuxcare.3." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:46112e35-2425-5343-af8f-a57d2891ab0c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.32-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:3585bd24-c59f-5120-88b4-7b44b74f679f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.32-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:45f26940-acc3-5733-82fb-9e1a8913478b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.32-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:205f86d6-a330-5d46-ac19-9ebea40339ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.32-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:f344dfe9-9f79-5511-84de-2e9c9192d21f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.32-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:d8cf257a-ea2f-54d6-b85d-221e12fcc55b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.32-tuxcare.2 of org.springframework:spring-context-support." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.3.32-tuxcare.2" } ] }