{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d047bb84-5f8b-5b12-8089-0c6ce98b6220", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context", "purl": "pkg:maven/org.springframework/spring-context@5.1.8.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context@5.1.8.RELEASE-tuxcare.1", "version": "5.1.8.RELEASE-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-context", "purl": "pkg:maven/org.springframework/spring-context@5.1.8.RELEASE", "type": "library", "group": "org.springframework", "version": "5.1.8.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c78cb7fc-dbae-5d13-bd20-9230ef848815", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 5.1.8.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2d137d6e-85ef-5761-ad97-372011a7e0f7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 5.1.8.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c63644b9-2f76-5c0d-8f50-c9a5cb6468de", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.1.8.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2b97f086-4ba7-5995-b2c0-f717469daa89", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 5.1.8.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7f07c5a9-583b-560e-a4e8-47d1a4751033", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 5.1.8.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1117786b-957a-5ea9-b19c-b90cf3010a57", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 5.1.8.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3299331e-2c41-5c26-b73c-5a124ca025b4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.1.8.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:27582c29-bc48-585e-a2cb-51956181192d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 5.1.8.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d8d3251b-74c5-5d10-9486-b59225f090e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.1.8.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e559c45d-aa73-5563-8127-0a4e65c8b631", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1257 affects version 5.1.8.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7e2d1f94-9bd5-5314-8039-f3475028d55b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 5.1.8.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d9d60ac6-fd3f-542e-a6aa-4df0c18c3197", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 5.1.8.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c53d6f65-cfce-5550-8c76-4d56cd19a43c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 5.1.8.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:bde8040d-db43-53cf-acb5-209aa832b408", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 5.1.8.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6fcb7bc4-88b7-5374-8eef-74889bb61f15", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.1.8.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6f3f1383-6b97-5573-ba30-c498f941d487", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 5.1.8.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:86683767-57e0-53c3-8157-7130487c8e81", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.1.8.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6bd7fe52-9d9e-5e90-9ab5-af32b5b3bfe9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.1.8.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:28083d23-bd5e-5555-883b-f05748b73393", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 5.1.8.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c27b35cb-24ff-57f3-8e41-c16197edb225", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.1.8.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8b8ed734-24d0-5988-93e0-417b86c53d09", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.1.8.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ebec26e4-9b64-509a-92f1-9a14dc764373", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.1.8.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:dc197cea-2d40-508f-9132-998b51e3276e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 5.1.8.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:aac3a3c3-150f-5b5b-ab97-ab10e7664566", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.1.8.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:52fa8eea-63ed-55ed-8522-0b36d5087cb4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.1.8.RELEASE-tuxcare.1 of org.springframework:spring-context. not_affected \u2014 CVE-2024-38820 is not present in Spring Framework 5.1.8.RELEASE. This CVE fixes a locale-dependent vulnerability in the CVE-2022-22968 fix, which introduced case-insensitive disallowedFields matching using String.toLowerCase(). The target version predates the CVE-2022-22968 fix and does not perform any case conversion in DataBinder's setDisallowedFields() or isAllowed() methods. The vulnerable ...", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c5b54026-4d3b-555d-bc03-8e0f865c4114", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.1.8.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f2dc998b-fec4-5a31-aea7-ac957f987dab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.1.8.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:da65a368-abe0-5224-b6cc-d941075690e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.1.8.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:188eaea0-57b9-584d-94b5-a93815746385", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.1.8.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d288f88e-4352-5511-82dc-1024fc29b0a3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.1.8.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3ecf22ec-78a2-51b0-9078-0bb919d23766", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.1.8.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7bb5512a-ee32-51dc-a280-ce9b0eeb2ebe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.1.8.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4c8a9847-cfd7-5193-930a-66d9538bac49", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.1.8.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7d935b3e-5123-5da1-82a5-fc97cba911c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.1.8.RELEASE-tuxcare.1 of org.springframework:spring-context." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5ac17db6-c92f-5d7e-98c1-ac7331744662", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.1.8.RELEASE-tuxcare.1 of org.springframework:spring-context." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context@5.1.8.RELEASE-tuxcare.1" } ] }