{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:fb065a1f-055c-5e35-bcfd-236220bf5453", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.1", "version": "4.3.20.RELEASE-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE", "type": "library", "group": "org.springframework", "version": "4.3.20.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:31a625fa-ac22-5500-96f1-9e39253706ad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:45f2b8ba-0191-5a55-abef-31e6df453dfc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:944b07e5-348c-52b5-9d1e-312892749471", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4e24a396-9f0c-5efd-b57e-77553a33d5de", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:09f1aa2d-3f8e-5373-9de5-5c7a8bee71a0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:27af6f4b-84d0-5b6d-bce1-eb594aa76786", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4ebf8ceb-7e22-569d-a952-8c0a55d9d067", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8759cc11-46d3-5d33-b08d-86634e5bcfad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:86023393-d874-536f-9b58-a99a3162f856", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ac90f4e3-089e-5a9e-830a-d58d6fbf3421", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-jms. not_affected \u2014 Target version 4.3.20.RELEASE is not affected by CVE-2018-1257. The vulnerability (regex DoS via malicious SpEL expressions in STOMP selector headers) was fixed by upstream Spring Framework in version 4.3.17 through two defensive measures: (1) switching from StandardEvaluationContext to SimpleEvaluationContext to restrict expression capabilities, and (2) adding configuration support to disable ...", "justification": "protected_at_runtime" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:901edc82-59b3-58af-8aa6-ea2ff833d814", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1270", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7d95fc2c-088c-5581-9255-93a33ab696c2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1270 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6ebdd63d-93c6-5b48-b42e-e6d53f5a5748", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2f1c1568-a23c-5d4e-9a0b-b29d927df663", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1275", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:dcf65566-d206-58c0-9ee6-1480490a0fa5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1275 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3a50895d-0328-5c71-8c89-5d2d4d112ae8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e89a33ca-20d7-5793-ac30-afcbc2dfe171", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5e7ddd1a-9fb4-51d0-b634-346a9a107cd7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:cb0c0341-078f-5978-a1f6-b50135a0fd49", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-jms, and is fixed in 4.3.20.RELEASE-tuxcare.2." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7474a30e-b6d4-5998-bd43-463210adb1fb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3f7c113d-9bbd-57f8-a8b6-5ec11275e8d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:bd0d3b31-e3d0-5f75-86fd-f76e217ce065", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a05ec995-0b25-5095-b1ab-df10bb9b8bca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:aa660716-dc4c-5a52-8541-6bb4ceb43b5c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:844f1acc-0bfb-5da0-834e-fb5f772e3127", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1a6e3ae5-676a-5eae-b4f8-ff72d0383de6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0cba08c9-8b23-511e-973f-ca33f6dc89b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6839528c-5e2e-50a0-93b8-1e1b09177c2e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-jms. not_affected \u2014 Version 4.3.20.RELEASE (released October 2018) predates CVE-2024-38820 (2024) and its prerequisite CVE-2022-22968 (2022). The target uses case-sensitive pattern matching in DataBinder with no toLowerCase() calls. CVE-2024-38820 specifically addresses \"String.toLowerCase() has some Locale dependent exceptions\" - this vulnerable code pattern is not present in the target. The target was released 4...", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7adca2d1-5cb1-5b4b-906e-eb0752999310", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5e0a41ce-4e87-5d53-8282-fcb1472f3443", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ea88e834-eba1-5bd9-9e57-6f0af490e3c1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:346ff6ab-c0ee-5e12-be6e-9a6316bd0f93", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ea1489f2-15c0-5f60-b7be-9d40356f48c9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e9947462-f075-56d8-89e6-ef005b93b9e5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c7361280-dc9b-5f7f-9fe2-4cb0ca1a70b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:56c4ed9b-55c7-5f7e-a9f6-5b3537cb3d83", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:da1f8c8a-26df-5500-b824-5b778615f359", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:45f88a4f-5efd-5819-979a-0506af15f33b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47888 does not affect version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-jms. CVE-2026-47888 is a memory leak in Spring Framework's RSocket support in spring-messaging, which was added in 5.2.0. Spring Framework 4.3.20.RELEASE contains no RSocket code, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:47f9ab8d-3a5b-56d5-b95c-6a3757d52820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:15c17311-3223-5c12-bc89-e4e6478577ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-jms." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.1" } ] }