{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2df1451c-49d2-5a4f-8f01-d61f5bc6e431", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@4.1.7.RELEASE-tuxcare.7", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jms@4.1.7.RELEASE-tuxcare.7", "version": "4.1.7.RELEASE-tuxcare.7", "pedigree": { "ancestors": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@4.1.7.RELEASE", "type": "library", "group": "org.springframework", "version": "4.1.7.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:c717265e-fe17-5dfa-adb3-afa1c944cb78", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:2a85f09c-4fab-5e32-a745-197871e312dd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:c94da115-1bed-5b23-96ca-1e84b19cad66", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:01671492-c365-50ce-901b-ff7fa90ddbde", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:486f7177-f87e-5f15-85d2-4ea7a5981549", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:a262ed85-d476-5819-8422-6e08f40d6cc2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2015-5211 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:3a82de24-bdee-523f-9387-4fe9aff1f099", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-5007 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:c1a46e52-e5e7-5497-ba17-64d99532c39b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-11040 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:73ab5d43-106b-516b-a79f-789eb1667a17", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:86a34f54-91b0-5af9-93d0-51573eaace5c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-jms. The version is not vulnerable. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:238df1dd-188b-5654-b83f-daf0ab67c154", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1270", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:3d51a932-357f-55fa-a632-973430fa20b0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1270 does not affect version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-jms. Version 4.1.7.RELEASE is not vulnerable. Summary: The target repository (Spring Framework 4.1.7.RELEASE) does not contain the vulnerable code. CVE-2018-1270 affects the SpEL-based message selector feature in the DefaultSubscriptionRegistry class, which uses StandardEvaluationContext to evaluate expressions - allowing remote code execution. However, this feature was not introduced until version 4.2.0.RC1 (commit b6327acec8 on 2015-04-21). The target version 4.1.7.RELEASE (released 2015-06-30) predates the introduction of this vulnerable feature and therefore is not affected by this CVE.", "justification": "code_not_present" } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:2c1d4da5-def2-56fb-ac85-ed898930a704", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:0161a584-2acc-5a2c-8700-581cd76ea297", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1275", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:b3e591d6-b443-5e24-816c-e948a8a6c7e2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1275 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:8c328c85-50e6-550b-9498-8b8541443f44", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:8b333521-b483-5647-a855-247a8636d5cc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:df1e87fc-1114-5fdf-b16e-5d29a06d6d1f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:79dcfbca-7e2a-549c-96cd-ad687eeb6033", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:9d052e31-0c53-56fb-98c2-e9e93e58cdb3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:ff2d2e33-3aa5-5ea8-b1ff-f7e14e773356", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:c2701779-5496-5883-8ab8-0c3c7a2d6455", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:a15f901b-6485-5517-9c0d-48747ad1a6d9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:37c08f7b-4e84-5fa1-ad4b-2f5b44bc188a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:4f6b9441-3a1d-5192-8e7d-a06eac3dde59", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:1752da94-5e9b-5bf8-ac80-ff8f40c1acde", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:7b3d028d-664f-5e77-bde8-875e8495b7e7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:5b5712c4-ef44-50a1-9a53-5f8f90a55faf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:f3e89754-108e-53ea-b9c0-52d15ef2864b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:cbd724b6-4680-59a1-a1cf-094706826a05", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:ec037cb6-d56b-50e0-973c-1b38c9144fc3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:fab9f60d-1ad4-599a-90ad-454bbdb32221", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:1e7ddd4d-7151-579e-a171-4f57b7151932", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:7081f7d9-b46c-5e50-9a1e-14a4396fb208", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:a91ef7ea-6645-5543-934d-7cf63b37b9ce", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:4980be63-866a-55a6-b9d6-49fa4063c5a1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41852 does not affect version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-jms. not_affected \u2014 Spring Framework 4.1.7.RELEASE is not affected by CVE-2026-41852. The vulnerability requires record-style property accessor support (empty-prefix method lookup), which was introduced in Spring 5.2+ and does not exist in version 4.1.7. While this version lacks void return type validation for getter methods, it cannot invoke arbitrary zero-argument methods as described in the CVE.", "justification": "code_not_present" } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:77aa5b64-cd28-5c54-aa0b-b2f6c047fa45", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:02f87000-5bfd-59c2-bb20-c9b1be026232", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:99973495-c4e8-58c4-86bf-6d767d0706cd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47888 does not affect version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-jms. CVE-2026-47888 is a memory leak in Spring Framework's RSocket support in spring-messaging, which was added in 5.2.0. Spring Framework 4.1.7.RELEASE contains no RSocket code, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:5231c1cb-d278-51bc-a7b9-ca8713effdf7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:27fa18c4-35b8-573e-a855-350adb3c4e53", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-jms." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.1.7.RELEASE-tuxcare.7" } ] }