{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6e687dfd-cdf7-5488-8866-c2e67f9c834d", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context", "purl": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.3", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.3", "version": "5.0.19.RELEASE-tuxcare.3", "pedigree": { "ancestors": [ { "name": "spring-context", "purl": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE", "type": "library", "group": "org.springframework", "version": "5.0.19.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:a7d80619-4a09-5be5-8e9e-ec1c96a5965c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 5.0.19.RELEASE-tuxcare.3 of org.springframework:spring-context." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:a4d2cbff-bb7d-575f-862a-40bfde037cad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 5.0.19.RELEASE-tuxcare.3 of org.springframework:spring-context." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:dc4efc65-7624-546e-8da5-fabcf4aa5bf1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.0.19.RELEASE-tuxcare.3 of org.springframework:spring-context." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:608ae657-cd98-5bd1-ab4a-90bc5399ef2f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 5.0.19.RELEASE-tuxcare.3 of org.springframework:spring-context." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:49417bda-a02c-5798-ae34-430d78a948ce", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 5.0.19.RELEASE-tuxcare.3 of org.springframework:spring-context." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:c551f986-4549-5fd5-8f34-d2ddc1b3f652", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 5.0.19.RELEASE-tuxcare.3 of org.springframework:spring-context." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:30f089a1-8d1f-5898-ad3e-9ff9d22ae8a9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.0.19.RELEASE-tuxcare.3 of org.springframework:spring-context." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:787b9c41-499c-5c6f-a6db-e5e485a88c8e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 5.0.19.RELEASE-tuxcare.3 of org.springframework:spring-context." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:f33a4ce6-25ff-52a9-906a-fa86ebc030f0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.0.19.RELEASE-tuxcare.3 of org.springframework:spring-context." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:ab522fcc-d192-5a78-b482-af0586d87279", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1257 affects version 5.0.19.RELEASE-tuxcare.3 of org.springframework:spring-context." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:2b18d37f-747c-5411-8386-af2eee41ea6e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 5.0.19.RELEASE-tuxcare.3 of org.springframework:spring-context." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:e4cb9fa9-0c11-5e34-b08b-d945e0a8474a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 5.0.19.RELEASE-tuxcare.3 of org.springframework:spring-context." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:d491c00c-ddd7-5c09-9b61-85fb529af139", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 5.0.19.RELEASE-tuxcare.3 of org.springframework:spring-context." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:61f00ba4-40a7-56bb-b121-f8ac906dd0f6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 5.0.19.RELEASE-tuxcare.3 of org.springframework:spring-context." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:8ae6c713-73ed-5c04-b084-bc5909921bf3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.0.19.RELEASE-tuxcare.3 of org.springframework:spring-context." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:d99863f9-eed8-55dd-b156-1e9d1bd247ea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.0.19.RELEASE-tuxcare.3 of org.springframework:spring-context." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:86828848-fb42-5821-9083-42613233333f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 5.0.19.RELEASE-tuxcare.3 of org.springframework:spring-context." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:87ca9e9f-faf4-58d9-a3ed-7a5432145d16", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 5.0.19.RELEASE-tuxcare.3 of org.springframework:spring-context." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:7521b3a6-5ca9-5436-a26d-b75c40f53eec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 5.0.19.RELEASE-tuxcare.3 of org.springframework:spring-context." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:7497596e-9d9f-583c-8232-0364dee61b9b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.0.19.RELEASE-tuxcare.3 of org.springframework:spring-context." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:649c1600-7259-5fd0-934c-2b099084e5e1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 5.0.19.RELEASE-tuxcare.3 of org.springframework:spring-context." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:c33f3680-38a4-5838-a652-a2ad9c885302", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.0.19.RELEASE-tuxcare.3 of org.springframework:spring-context." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:7c78edd8-4995-508a-a572-5d802b9d1c02", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 5.0.19.RELEASE-tuxcare.3 of org.springframework:spring-context." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:1072e9cd-8965-5b41-bae0-d2ec820ffb44", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.0.19.RELEASE-tuxcare.3 of org.springframework:spring-context." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:a154b818-a4e3-5f18-b9c0-2a7354f13eec", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.0.19.RELEASE-tuxcare.3 of org.springframework:spring-context. not_affected \u2014 Target version 5.0.19.RELEASE does not contain the vulnerable code pattern from CVE-2024-38820. The vulnerability requires the presence of CVE-2022-22968 fix (which added case-insensitive field matching via toLowerCase()), but this version never received that fix. The target uses case-sensitive matching for disallowedFields without any toLowerCase() calls, so the locale-dependent toLowerCase() ...", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:6cfcff9d-d6b3-5ccd-ba59-d5c918ee314d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.0.19.RELEASE-tuxcare.3 of org.springframework:spring-context." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:4cf93259-ce7c-5410-9de4-5637da527b68", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.0.19.RELEASE-tuxcare.3 of org.springframework:spring-context." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:f003320a-5ba2-55a4-8c76-ad9f652be4d1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.0.19.RELEASE-tuxcare.3 of org.springframework:spring-context." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:18931f09-abfc-54f3-8032-6e3bf8e299af", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.0.19.RELEASE-tuxcare.3 of org.springframework:spring-context." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:128a6e3d-72f3-508f-9888-6195aee73657", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.0.19.RELEASE-tuxcare.3 of org.springframework:spring-context." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:26aa7f55-b15f-5812-912a-60935bee5dfb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.0.19.RELEASE-tuxcare.3 of org.springframework:spring-context." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:a2b14ad3-233a-517a-9e74-585de02b2fb0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.0.19.RELEASE-tuxcare.3 of org.springframework:spring-context." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:fc8f6474-be57-50f4-9545-39db8f8df32b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.0.19.RELEASE-tuxcare.3 of org.springframework:spring-context." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:8de2787f-c506-5dc3-8a6c-221bf7ed415c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.0.19.RELEASE-tuxcare.3 of org.springframework:spring-context." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:b9386ffc-2547-5eb9-a0bd-1ea28ea05ad9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.0.19.RELEASE-tuxcare.3 of org.springframework:spring-context." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context@5.0.19.RELEASE-tuxcare.3" } ] }