{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c87961c1-1a57-5d43-b63e-6dbfb4f65c3f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jdbc", "purl": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.5", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.5", "version": "6.0.12-tuxcare.5", "pedigree": { "ancestors": [ { "name": "spring-jdbc", "purl": "pkg:maven/org.springframework/spring-jdbc@6.0.12", "type": "library", "group": "org.springframework", "version": "6.0.12" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:f8312949-9040-518e-90ed-cb9db59cef0d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 6.0.12-tuxcare.5 of org.springframework:spring-jdbc." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:20741819-d6fa-5ab1-9b4d-7f53ebea67b0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.0.12-tuxcare.5 of org.springframework:spring-jdbc." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:c79034ac-f07d-5590-8008-8e4c9c606283", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.0.12-tuxcare.5 of org.springframework:spring-jdbc." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:f9126b61-521a-555c-b731-0a0670254dbd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.0.12-tuxcare.5 of org.springframework:spring-jdbc." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:716f2e58-285e-5937-a5f3-92053487d2cf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.0.12-tuxcare.5 of org.springframework:spring-jdbc." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:4af61880-09fb-5641-86bc-a03628e5d590", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.0.12-tuxcare.5 of org.springframework:spring-jdbc." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:d759609a-857e-501e-9222-c172658b7960", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.0.12-tuxcare.5 of org.springframework:spring-jdbc." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:6882c6e1-07be-5aff-a4cf-43bfde42ff83", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.0.12-tuxcare.5 of org.springframework:spring-jdbc." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:b2831022-ec30-5d70-b004-b2058fc987f0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.0.12-tuxcare.5 of org.springframework:spring-jdbc." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:f2f6297d-e177-51cf-a849-4f60d2ae1865", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.0.12-tuxcare.5 of org.springframework:spring-jdbc. not_affected \u2014 Spring Framework v6.0.12 is not affected by CVE-2018-1257. The vulnerability affected versions prior to 4.3.17 and 5.0.6, which lacked the ability to disable the SpEL-based selector feature in STOMP messaging. The fix (commit ff2228fdaf131d57b5c8c5918ee8d07c6dd9bbac, April 2018 by Rossen Stoyanchev) added a null check and the ability to set selectorHeaderName to null to disable selector parsing...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:e3f426af-dd5b-5aba-b9a6-7ceb295dc7c3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.0.12-tuxcare.5 of org.springframework:spring-jdbc." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:765e634c-6112-5040-ac95-d281ff0d4065", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.0.12-tuxcare.5 of org.springframework:spring-jdbc." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:4b8a2ab6-f5e1-5f52-afc0-e4c128e5edc3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.0.12-tuxcare.5 of org.springframework:spring-jdbc." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:1597993d-9686-5539-98c2-3526659f6722", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.0.12-tuxcare.5 of org.springframework:spring-jdbc." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:e40a408a-1e8e-5e61-805e-1c64881123f6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.0.12-tuxcare.5 of org.springframework:spring-jdbc." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:fd753afe-56a2-5326-a39a-056bcfac913f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.0.12-tuxcare.5 of org.springframework:spring-jdbc." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:fd84984a-39ae-5e5d-85c3-20c778ed44b2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.0.12-tuxcare.5 of org.springframework:spring-jdbc. Spring Framework 6.0.12 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:e3bf26b7-7656-5bbb-8b58-57feb1495aed", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.0.12-tuxcare.5 of org.springframework:spring-jdbc. not_affected \u2014 CVE-2022-22970 affects Spring Framework applications that use data binding with file upload types (MultipartFile/Part), causing DoS through resource exhaustion when introspection repeatedly calls expensive getters like getInputStream(). The fix excludes read-only properties returning AutoCloseable, ClassLoader, and ProtectionDomain types from JavaBean introspection. Target version 6.0.12 is NOT...", "justification": "code_not_present" } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:da1f1324-4d58-521e-8db9-f21509ab999a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.0.12-tuxcare.5 of org.springframework:spring-jdbc." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:6b92e61e-f122-5c13-9889-391c4781bdb1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 6.0.12-tuxcare.5 of org.springframework:spring-jdbc, and is fixed in 6.0.12-tuxcare.6." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:a2ea0c28-f838-5517-a835-b5e44faf856e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 6.0.12-tuxcare.5 of org.springframework:spring-jdbc, and is fixed in 6.0.12-tuxcare.6." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:3461d5b4-c7bc-51e6-8d08-0ac3e89063e9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.12-tuxcare.5 of org.springframework:spring-jdbc." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.0.12-tuxcare.5" } ] }