{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f75f0e56-5888-5c73-b4a2-ba403ac64f8a", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jdbc", "purl": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.12", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.12", "version": "5.3.29-tuxcare.12", "pedigree": { "ancestors": [ { "name": "spring-jdbc", "purl": "pkg:maven/org.springframework/spring-jdbc@5.3.29", "type": "library", "group": "org.springframework", "version": "5.3.29" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:cddd152c-a2dc-5ee4-aacf-a453a1995602", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2009-1190 does not affect version 5.3.29-tuxcare.12 of org.springframework:spring-jdbc. not_affected \u2014 CVE-2009-1190 targets an algorithmic complexity vulnerability in JDK Pattern.compile (before JDK 1.6) when exposed through Spring Framework's property binding. While Spring 5.3.29 retains PatternEditor code that calls Pattern.compile without Spring-level validation, the target is not affected because it requires JDK 8+ to run. All supported JDK versions include the algorithmic complexity fix fr...", "justification": "requires_environment" } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:86e914d0-76b4-55d6-810a-0e0842d3e06a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 5.3.29-tuxcare.12 of org.springframework:spring-jdbc." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:bda73360-f5ab-59d1-830e-06139b529550", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.3.29-tuxcare.12 of org.springframework:spring-jdbc." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:0f975d8b-c148-549c-80ec-810abcfdd5d2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 5.3.29-tuxcare.12 of org.springframework:spring-jdbc." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:8f9d1cc1-ac95-5239-a8bf-a389630b7a24", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 5.3.29-tuxcare.12 of org.springframework:spring-jdbc." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:a6b55230-61be-5fc2-bad4-18e022a914a3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 5.3.29-tuxcare.12 of org.springframework:spring-jdbc." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:28aa8f47-916b-5b6c-af4d-02ca17966a64", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.3.29-tuxcare.12 of org.springframework:spring-jdbc." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:9ff4595f-2d2c-5277-ab08-369c8629db2d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 5.3.29-tuxcare.12 of org.springframework:spring-jdbc." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:24f95e86-7476-5fca-a450-ae53982e45af", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.3.29-tuxcare.12 of org.springframework:spring-jdbc." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:f5477095-adab-53f6-a42a-1a71e8380a5f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 5.3.29-tuxcare.12 of org.springframework:spring-jdbc. not_affected \u2014 CVE-2018-1257 affects Spring Framework versions 5.0.x prior to 5.0.6 and 4.3.x prior to 4.3.17, involving a regular expression denial of service through malicious STOMP selector headers. The target version 5.3.29-tuxcare.12 is not affected because the fix was already present in the upstream Spring Framework 5.3.29 release. The vulnerable code pattern (unconstrained parsing of selector expressio...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:3e96c7a5-9a1a-56dd-9b27-79c28e1dd6c4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 5.3.29-tuxcare.12 of org.springframework:spring-jdbc." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:93e9a0ef-aadd-5b9e-8e80-5880d231d04f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 5.3.29-tuxcare.12 of org.springframework:spring-jdbc." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:8bd7cf1b-45d3-522f-91f4-6eb18bce4d21", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 5.3.29-tuxcare.12 of org.springframework:spring-jdbc." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:6e2c2eb7-586a-5d9b-a606-d8191ede61b1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 5.3.29-tuxcare.12 of org.springframework:spring-jdbc." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:9ff2b285-8e8a-5dc2-adef-111c95621326", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.3.29-tuxcare.12 of org.springframework:spring-jdbc." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:8688818f-ca6c-5718-81bf-067f3c09f6e7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.3.29-tuxcare.12 of org.springframework:spring-jdbc." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:834418a7-0170-5540-9ceb-033ca537b548", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 5.3.29-tuxcare.12 of org.springframework:spring-jdbc. Spring Framework 5.3.29 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:c5955d0b-5e26-5605-b7e9-d83dc5e2b095", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 5.3.29-tuxcare.12 of org.springframework:spring-jdbc. not_affected \u2014 CVE-2022-22970 has been fixed in the target Spring Framework 5.3.29. The vulnerability involved unfiltered AutoCloseable-typed read-only properties during bean introspection, enabling DoS attacks through file upload data binding. The upstream fix (commit 83186b689f, May 2022) added filtering for AutoCloseable, ClassLoader, ProtectionDomain, and URL.content properties. A refinement (commit ec3f5...", "justification": "code_not_present" } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:e8269f7b-be6a-51e6-af2f-f9201670a2c2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 5.3.29-tuxcare.12 of org.springframework:spring-jdbc." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:41faf0c0-b3ed-5588-ba4b-16fc64e8f30c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.29-tuxcare.12 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:584d8c48-a139-5c9d-8cfb-ac45eb47bd21", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.29-tuxcare.12 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:32a38fbf-927a-5314-a596-74d923838869", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.29-tuxcare.12 of org.springframework:spring-jdbc." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.3.29-tuxcare.12" } ] }