{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:fec9b9bd-67e7-56b2-89ba-b2e8cf0210fc", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context", "purl": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.11", "version": "5.3.29-tuxcare.11", "pedigree": { "ancestors": [ { "name": "spring-context", "purl": "pkg:maven/org.springframework/spring-context@5.3.29", "type": "library", "group": "org.springframework", "version": "5.3.29" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:84e912af-fe26-59ff-915c-63b1c71c2f1c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 5.3.29-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:dbf83ae9-384c-5569-bed6-fccef142644a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 5.3.29-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:b6c4fddd-c48a-5793-a416-0d1c54bde6a7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.3.29-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:1a1d1e32-cfb8-5f29-b04a-1778baaf3116", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 5.3.29-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:75c2316e-c888-5ef9-a8ac-034802db002d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 5.3.29-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:0c5b9d69-183c-57f2-a639-2bf0139e54bf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 5.3.29-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:d2089e78-b68f-5b46-acd5-e17f683f76a1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.3.29-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:c9261823-36ec-5117-8297-1c19821590c4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 5.3.29-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:51d58c7b-5e90-5bba-9d30-46572f5171cb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.3.29-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:8ef7e1e2-3df7-5293-8a32-08ea6a57bdaa", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 5.3.29-tuxcare.11 of org.springframework:spring-context. not_affected \u2014 CVE-2018-1257 affects Spring Framework versions 5.0.x prior to 5.0.6 and 4.3.x prior to 4.3.17, involving a regular expression denial of service through malicious STOMP selector headers. The target version 5.3.29-tuxcare.12 is not affected because the fix was already present in the upstream Spring Framework 5.3.29 release. The vulnerable code pattern (unconstrained parsing of selector expressio...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:bd561222-025a-52b2-b64f-8ceb3ace567f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 5.3.29-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:188fd441-d65e-59c2-b3e0-dbdaab2896e1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 5.3.29-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:6dca14ba-8f73-5752-9a74-c3c17c14a33f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 5.3.29-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:f3be88de-45b2-53c0-ae01-852fccb7ef3b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 5.3.29-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:53d01f76-b057-5393-a7ae-5cee432cb907", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.3.29-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:7d1b1ba2-23ca-5a6a-a26b-f60a3e70bd2b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.3.29-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:2f8eead6-917c-5354-bd77-c05df626146f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 5.3.29-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:261c6daa-3a9f-5208-8918-9f85863cfda5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 5.3.29-tuxcare.11 of org.springframework:spring-context. Spring Framework 5.3.29 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:9d91c378-4f67-5ae7-bdfe-0bec285114fd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 5.3.29-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:7e169b95-4cff-5999-819d-0be2f3113e1b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 5.3.29-tuxcare.11 of org.springframework:spring-context. not_affected \u2014 CVE-2022-22970 has been fixed in the target Spring Framework 5.3.29. The vulnerability involved unfiltered AutoCloseable-typed read-only properties during bean introspection, enabling DoS attacks through file upload data binding. The upstream fix (commit 83186b689f, May 2022) added filtering for AutoCloseable, ClassLoader, ProtectionDomain, and URL.content properties. A refinement (commit ec3f5...", "justification": "code_not_present" } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:0b848bc3-f9cb-5718-9bd2-029115d43406", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.3.29-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:0e3f2876-3773-5b32-8fbb-eed21f49ef8f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.3.29-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:920f9823-b972-548c-934c-cc602842b3fd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 5.3.29-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:2caddb81-7f44-5153-8e39-3b8c9bc15dd6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:7d81caa4-cb30-5e34-8f0f-c5c38ff57a0b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:a29e94a6-4395-50dc-8f17-df52c9f3522b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:65dc39f2-1ba0-56d7-9f16-f2eb3768779e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:ec665f06-4038-5b98-90d1-d8486a496025", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:49f2f721-b458-5620-8eaf-2b8a45778c1c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:01e2601d-56e6-542a-b03c-0291dcf82bb1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:64c04fad-b08e-5d52-8cfb-b1fbe9044546", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:194aced9-cb87-524e-aa70-fe612c680694", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:1481c12b-d63d-5592-8060-62910371cee9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:bedb72f0-0093-54e7-ab06-9ff19daae78a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-context." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:615e3736-3a0f-5b97-9f3c-4e1477f500ee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-context." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.11" } ] }