{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e05618eb-ac34-50f3-a31e-f179fdd0071b", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@6.1.15-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context-support@6.1.15-tuxcare.6", "version": "6.1.15-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@6.1.15", "type": "library", "group": "org.springframework", "version": "6.1.15" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:585771b4-adee-5a00-bba5-2ac64c084560", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 6.1.15-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:6f8e5b53-e093-5372-b762-c0ba1677dd1d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.1.15-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:10d877df-9779-5b19-9ccf-ee15004ccf65", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.1.15-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:e4f60ad4-2f37-5bdc-b5c6-2584bad949da", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.1.15-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:f654bede-6830-58bb-9319-6ad17bc0ba86", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.1.15-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:3ff06eeb-9886-50ff-879a-6e83e9f5a193", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.1.15-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:e2a9056e-97cc-5c02-89b8-25943155ac94", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.1.15-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:58dd9885-293d-51a4-adaa-71aeaec0e9e1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.1.15-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:c19dbf53-9099-5f63-af48-5fc9a6861bc9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.1.15-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:95d57e75-3079-52b4-a79d-72aa067ef8c9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1257 affects version 6.1.15-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:f3b3883a-af66-59ea-97ae-211c089e312e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.1.15-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:5d6c83ae-2a18-58c1-89b3-31fb579b51a4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.1.15-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:3476d784-7312-59fb-bd64-100b7821ca2d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.1.15-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:e8526ef9-e2b9-5753-99a0-e4fed50d99ac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.1.15-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:a8460215-011d-5471-8526-d8a2695a26e2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.1.15-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:efc7cf39-813c-58cb-ad1d-e3156398787d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.1.15-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:76683526-c5f2-5216-8d38-3ba208805056", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 6.1.15-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:6f7d88dd-7a76-5649-8e11-7ceef1401079", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 6.1.15-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:87664bde-501b-5112-adca-e667eb591aeb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 6.1.15-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:0769e10f-3535-5a1e-a596-b17120ce0562", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 6.1.15-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:5c61a476-e51c-530c-a2b2-c375e58dbb7b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 6.1.15-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:8f7531ca-0022-56ac-a811-55569973bd2f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 6.1.15-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:fe84669d-3a08-50a4-b7ef-277ac2d92976", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.1.15-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:40a7a21f-f9c6-5255-b3e6-38cda2562cb2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 6.1.15-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:1c433ec1-80e8-5ab0-8e84-204ca1d12b26", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 6.1.15-tuxcare.6 of org.springframework:spring-context-support. not_affected \u2014 Spring Framework 6.1.15 upstream release already contained the fix for CVE-2024-38820 (commit 23656aebc6 by Rossen Stoyanchev, using Locale.ROOT for case conversion). TuxCare onboarded this already-fixed version. The vulnerable pattern (String.toLowerCase() without explicit Locale, causing Turkish-I and similar locale-dependent mismatches in disallowed field protection) was never present in the...", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:f9103b3c-b068-5c53-a9c6-0c5314bf39c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:55f392c3-808a-54ef-890b-ef7bf3444e3c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:bea4a4fc-bccc-5777-b740-93db3f782958", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:548e56ae-f77f-5369-9913-12e2d610cc9f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 6.1.15-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:85411cc8-0024-5b74-b337-60f1018a8813", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:3942a1ae-e14a-5e85-99fe-ed9b527bccdc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:36729988-a82c-5f6d-a22c-d21fe36331dc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:a82b7291-0cd1-57fa-ba14-bb3f47320912", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:88d0600e-839b-5ab9-833f-b0e11286ef4f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:f4c7cf6d-6074-5f95-a701-8a3a42b4cb88", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:7e320867-2b72-5b42-9bd5-62fa6afe52a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-context-support." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context-support@6.1.15-tuxcare.6" } ] }