{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7e0ceee9-7d2b-511b-83c6-66b8e28d031f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context", "purl": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.12", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.12", "version": "5.3.29-tuxcare.12", "pedigree": { "ancestors": [ { "name": "spring-context", "purl": "pkg:maven/org.springframework/spring-context@5.3.29", "type": "library", "group": "org.springframework", "version": "5.3.29" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:f10835bf-e3e7-592e-9cc9-ac274557d07d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 5.3.29-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:008a1831-12e2-529b-ab33-bd9f520733f8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 5.3.29-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:b4f0a5f0-160a-5621-a62b-d4b8c02c7cdb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.3.29-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:e1b81bad-9626-5a7b-9c15-92b13dc5d632", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 5.3.29-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:62e40607-7a7f-5dc2-a161-3733c634ce88", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 5.3.29-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:931fa826-d504-5bec-8116-0737c6442098", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 5.3.29-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:ff801f00-b5d4-528a-9198-b9c919773f3f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.3.29-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:b4108e81-68ce-5d0c-bacc-450208e86107", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 5.3.29-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:000369ba-0aa4-5516-af19-7cf382b08b37", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.3.29-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:eae82bca-263d-5903-9cde-15ff9232a715", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 5.3.29-tuxcare.12 of org.springframework:spring-context. not_affected \u2014 CVE-2018-1257 affects Spring Framework versions 5.0.x prior to 5.0.6 and 4.3.x prior to 4.3.17, involving a regular expression denial of service through malicious STOMP selector headers. The target version 5.3.29-tuxcare.12 is not affected because the fix was already present in the upstream Spring Framework 5.3.29 release. The vulnerable code pattern (unconstrained parsing of selector expressio...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:6e768e58-1c52-56c0-a0d2-da28574cb652", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 5.3.29-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:9f2c6fe6-addb-5cef-8128-fa6778869733", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 5.3.29-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:80652645-92d2-5d9b-b908-1ba7ba8a25b0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 5.3.29-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:484bb870-180a-534c-bffa-14e5eed526d8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 5.3.29-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:88ef12fd-3ac8-52a8-a512-663770d13380", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.3.29-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:b204df59-478a-5284-9ff1-760eaf303019", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.3.29-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:815c7085-671a-58c5-8ee2-71cdffe26847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 5.3.29-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:daec1e7b-d45b-5832-8bb2-171f165ceeec", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 5.3.29-tuxcare.12 of org.springframework:spring-context. Spring Framework 5.3.29 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:5b0b2ddd-9783-5e1a-ab2d-5ff8ff07feef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 5.3.29-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:d01daed8-8c8c-5ff9-804d-525806636dfb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 5.3.29-tuxcare.12 of org.springframework:spring-context. not_affected \u2014 CVE-2022-22970 has been fixed in the target Spring Framework 5.3.29. The vulnerability involved unfiltered AutoCloseable-typed read-only properties during bean introspection, enabling DoS attacks through file upload data binding. The upstream fix (commit 83186b689f, May 2022) added filtering for AutoCloseable, ClassLoader, ProtectionDomain, and URL.content properties. A refinement (commit ec3f5...", "justification": "code_not_present" } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:5b49c2ea-5bb5-580f-b0f4-b8dd53a29ec1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.3.29-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:619b25b1-4dc8-5520-ade5-72eae765389e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.3.29-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:984a1e32-a13b-5784-9667-d96107648f46", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 5.3.29-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:1d70756f-8917-50d6-8001-8fb792bb4250", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.29-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:82f643ca-338c-557e-ac45-cc60f5342ff9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.29-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:da9f9671-3ef2-5d92-88ec-0a3040656e1e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.29-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:882377e0-f393-5971-8b9b-1d7feac7541b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.29-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:3cd77ff7-816f-518f-9282-6482c660dd88", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.29-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:4eeda7ec-203c-5bfc-afcb-604470934418", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.29-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:d9c456fe-4252-54e0-9ca5-fe415cfc2614", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.29-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:17cf7995-e00f-51ce-97c0-59d85c0b3241", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.29-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:4d6a6b7b-fa79-5599-a21b-ca76f9c7084b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.29-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:9765680d-c5f2-53b7-b1d6-10fa8de66101", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.29-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:803711da-0391-595a-8840-c42684bd648c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.29-tuxcare.12 of org.springframework:spring-context." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:01bae5ba-1a58-5e80-898b-f3fe55d063c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.29-tuxcare.12 of org.springframework:spring-context." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context@5.3.29-tuxcare.12" } ] }