{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ca9a7f96-bc6f-51c9-a282-02b6fbd3dd56", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jdbc", "purl": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11", "version": "5.3.29-tuxcare.11", "pedigree": { "ancestors": [ { "name": "spring-jdbc", "purl": "pkg:maven/org.springframework/spring-jdbc@5.3.29", "type": "library", "group": "org.springframework", "version": "5.3.29" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:c561bc7f-1adc-5d83-9958-e6e16b1779e0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2009-1190 does not affect version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc. not_affected \u2014 CVE-2009-1190 targets an algorithmic complexity vulnerability in JDK Pattern.compile (before JDK 1.6) when exposed through Spring Framework's property binding. While Spring 5.3.29 retains PatternEditor code that calls Pattern.compile without Spring-level validation, the target is not affected because it requires JDK 8+ to run. All supported JDK versions include the algorithmic complexity fix fr...", "justification": "requires_environment" } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:f0e5a7ae-3e45-5d78-a761-9290c72645b0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:a8ebec8e-1c36-59c6-8899-e0f578c9117a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:f2f77b08-6b71-5bc0-a3c3-476f1c7d7dbd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:3c71dd8a-4574-5956-b1a7-ce220a253ee0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:45faa714-beee-5f42-9425-97a7af620b10", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:eb3a2340-f757-525d-94a1-c4bb4f159e91", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:c1052dd8-4ccc-5baf-aa17-56d199eae8e7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:826af031-11b4-5004-8b51-9d52513109cc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:7daca92f-8f81-599e-b1bf-3bb0dd8c6a27", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc. not_affected \u2014 CVE-2018-1257 affects Spring Framework versions 5.0.x prior to 5.0.6 and 4.3.x prior to 4.3.17, involving a regular expression denial of service through malicious STOMP selector headers. The target version 5.3.29-tuxcare.12 is not affected because the fix was already present in the upstream Spring Framework 5.3.29 release. The vulnerable code pattern (unconstrained parsing of selector expressio...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:c8e1c142-0d92-5484-9848-f8aa06a4ba81", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:3595a7b8-44c9-58d6-9161-b934b20c2a5c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:76fc3607-5745-5a0c-b399-3f09bf72d203", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:26daa07d-e4bd-5d62-84d8-905084a4bbf7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:ab548a43-de75-5be2-8f93-5e8bc1682063", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:c710f68a-d8d7-55b3-af3c-30ebfece1500", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:4e9d0a31-b8ef-5185-bf90-a2ebf5c80497", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc. Spring Framework 5.3.29 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:a68d666d-1bcf-5add-bf65-770a3447e5d9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc. not_affected \u2014 CVE-2022-22970 has been fixed in the target Spring Framework 5.3.29. The vulnerability involved unfiltered AutoCloseable-typed read-only properties during bean introspection, enabling DoS attacks through file upload data binding. The upstream fix (commit 83186b689f, May 2022) added filtering for AutoCloseable, ClassLoader, ProtectionDomain, and URL.content properties. A refinement (commit ec3f5...", "justification": "code_not_present" } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:677deb1b-d1bc-53f6-9ce6-3ca728e749d4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:424cb1ac-d0e3-50ee-93bf-128431a80d6e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:77b70ccb-7edb-5f5f-aba3-b2c4033332f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:bb6410b9-01e3-5279-87ba-14588876716a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jdbc." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.11" } ] }