{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7a34d106-bbe3-5393-8686-de5874b42fc1", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jdbc", "purl": "pkg:maven/org.springframework/spring-jdbc@6.1.4-tuxcare.7", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jdbc@6.1.4-tuxcare.7", "version": "6.1.4-tuxcare.7", "pedigree": { "ancestors": [ { "name": "spring-jdbc", "purl": "pkg:maven/org.springframework/spring-jdbc@6.1.4", "type": "library", "group": "org.springframework", "version": "6.1.4" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:8dab0ccb-dcce-5aae-b39f-ca5fa21107b5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 6.1.4-tuxcare.7 of org.springframework:spring-jdbc." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:a24b78bd-6635-59be-ac54-e2069236dbcf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.1.4-tuxcare.7 of org.springframework:spring-jdbc." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:4e6d3b19-2316-5656-8010-50f157d7e15e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.1.4-tuxcare.7 of org.springframework:spring-jdbc." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:d2f003c1-73ca-57ca-be7e-c62486190f6b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.1.4-tuxcare.7 of org.springframework:spring-jdbc." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:90ac14ef-545c-5a99-84a5-f598673d47f3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.1.4-tuxcare.7 of org.springframework:spring-jdbc." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:8e35cf61-72b2-58cc-ac74-232a7572fdd3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.1.4-tuxcare.7 of org.springframework:spring-jdbc." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:b502c4ff-f4ae-5a75-a717-ced7c99e65c3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.1.4-tuxcare.7 of org.springframework:spring-jdbc." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:5f440076-c681-5a2a-aad5-2a5571cd5325", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.1.4-tuxcare.7 of org.springframework:spring-jdbc." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:bff51236-d13d-58c9-abd2-3314f39978f9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.1.4-tuxcare.7 of org.springframework:spring-jdbc." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:40466f56-a069-5fc6-bebe-996a47226307", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.1.4-tuxcare.7 of org.springframework:spring-jdbc. not_affected \u2014 Spring Framework 6.1.4 is not affected by CVE-2018-1257. The vulnerability (DoS via malicious STOMP selector header causing regex/expression parsing exhaustion) was fixed in upstream Spring Framework 4.3.17 and 5.0.6 (April 2018). The fix - a null-check that skips selector expression parsing when the feature is disabled - is present in version 6.1.4. Additionally, as of Spring Framework 6.1, th...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:90789c3d-b899-52f7-a568-f7624cc1e837", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.1.4-tuxcare.7 of org.springframework:spring-jdbc." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:84aa3f0f-8105-5cdf-8dae-93169819bd49", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.1.4-tuxcare.7 of org.springframework:spring-jdbc." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:613ee0be-cb5f-5dff-9e3b-d79e01d47f2c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.1.4-tuxcare.7 of org.springframework:spring-jdbc." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:ec6e03eb-738d-58d7-b218-c2d1dff16d66", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.1.4-tuxcare.7 of org.springframework:spring-jdbc." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:bdc233b7-ac32-5c00-bf0c-1d612425e081", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.1.4-tuxcare.7 of org.springframework:spring-jdbc." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:b349c340-cddb-5bfe-bcd9-c67e3515291b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.1.4-tuxcare.7 of org.springframework:spring-jdbc." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:f0d2462e-fd65-5485-b860-a3d0432ec2df", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.1.4-tuxcare.7 of org.springframework:spring-jdbc. Spring Framework 6.1.4 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:c69d16da-334f-5446-b329-31d9f698be38", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.1.4-tuxcare.7 of org.springframework:spring-jdbc. not_affected \u2014 Spring Framework 6.1.4 is not affected by CVE-2022-22970. The fix was already present in the upstream Spring Framework 6.1.4 release that TuxCare onboarded. The vulnerability (DoS via data binding to dangerous read-only properties like AutoCloseable types and URL.content) was addressed in upstream commit 83186b689f11f5e6efe7ccc08fdeb92f66fcd583 by Juergen Hoeller on May 11, 2022, well before ve...", "justification": "code_not_present" } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:9d61cf8a-4a93-5504-85b7-8034eba74bc4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.1.4-tuxcare.7 of org.springframework:spring-jdbc." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:44bd27f2-3722-5de2-aabb-7058eab4c4af", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.1.4-tuxcare.7 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:4fb321d4-8277-5dec-97cc-3e43c21bb035", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 6.1.4-tuxcare.7 of org.springframework:spring-jdbc, and is fixed in 6.1.4-tuxcare.8." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:0c36a8d4-e1c1-5803-abbc-18b213851add", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.1.4-tuxcare.7 of org.springframework:spring-jdbc." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@6.1.4-tuxcare.7" } ] }