{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d71b4d9c-00e8-5767-b95b-bc6a822c0b09", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.2", "version": "4.3.20.RELEASE-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE", "type": "library", "group": "org.springframework", "version": "4.3.20.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:afbc1ee3-7f57-5bf0-8eca-92a93ffa6d0f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e6fbbf1c-8648-586e-bd3b-78ed40469df3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:faebb3fb-9315-5adc-b1e0-78986eb051fa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1df8ab47-ee2a-504b-92a6-a68f4e253783", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:794f7e20-0ebd-5369-8ceb-da790d565596", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:39c1bf43-ef96-5b34-8570-850c11de5152", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bc3044fc-721b-513c-a188-9141852227d3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0421afec-f2bc-5d86-b3c4-0529498d1108", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:56ddadac-ab89-523d-924d-b77d02bb2d82", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:98d05899-8086-5ea0-bbe7-d47a047e0462", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-jms. not_affected \u2014 Target version 4.3.20.RELEASE is not affected by CVE-2018-1257. The vulnerability (regex DoS via malicious SpEL expressions in STOMP selector headers) was fixed by upstream Spring Framework in version 4.3.17 through two defensive measures: (1) switching from StandardEvaluationContext to SimpleEvaluationContext to restrict expression capabilities, and (2) adding configuration support to disable ...", "justification": "protected_at_runtime" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7ae1ba50-9a10-540b-811c-f33b3938f761", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1270", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:35a6750e-d37b-551b-863c-d7b16a2e5359", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1270 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:177b859b-a27c-5eda-af18-5a564c043c56", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f34ef47e-6c5e-5cc1-b5c5-fb624f4a9805", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1275", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f8c85841-abc7-591b-af5d-3fa490a2d0e7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1275 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:385e3509-f37c-5f3b-bc04-5692fabd30f2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bae32002-67ff-5007-bd11-16459d642c4e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:be1da15c-b27a-5a25-acd7-e81bce8e67e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:db656f71-b5ec-553e-b545-5e225b394fb0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:772a1335-7c0d-5b5d-b5e2-f2c14d8d6479", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:989df6bb-25aa-5ede-9c89-41383fc79102", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f7952b51-7e22-53b3-b7ee-4f7a3bf78d17", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d0e18d22-7c10-5b3f-8768-6ef1cc9b99be", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:aa259b00-6677-5a3a-8db7-1fb2670c9582", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b83cc69b-d56d-5140-b91b-3f48f9afa7fd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e5d2b849-48f8-5e0b-9b1a-55c254237e9b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:96ac8333-e9cc-51a8-820c-a2772a97b3b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:03c725c9-a0ed-5711-a2a4-bff742628499", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-jms. not_affected \u2014 Version 4.3.20.RELEASE (released October 2018) predates CVE-2024-38820 (2024) and its prerequisite CVE-2022-22968 (2022). The target uses case-sensitive pattern matching in DataBinder with no toLowerCase() calls. CVE-2024-38820 specifically addresses \"String.toLowerCase() has some Locale dependent exceptions\" - this vulnerable code pattern is not present in the target. The target was released 4...", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:42c3157e-0523-5a78-b55d-7e6e4b94fffa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ddda099f-0e88-5374-9b82-80cbfe71b9d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a9c150a4-0d8e-5d4f-b923-e13db38d669a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:73fd2e82-9230-5002-9e78-03b5bb4674e5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:aac53f44-2249-5ad5-9276-da3bb68fc131", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ecb7ec94-3b4b-5f94-8e8d-9225b25597b1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2ca92d76-49b2-5e81-a06b-b48a593a6dae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0095c200-e859-58c5-be9c-1bad5b80c5a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1571b7ac-e542-5ba9-90d0-99b195a642bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:aa07e797-d134-5a91-b9cd-3868a7f11c2a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47888 does not affect version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-jms. CVE-2026-47888 is a memory leak in Spring Framework's RSocket support in spring-messaging, which was added in 5.2.0. Spring Framework 4.3.20.RELEASE contains no RSocket code, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:71842c03-37f6-52f4-aa3e-ff53b9574d92", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:951ccac7-b4cf-5df4-b63b-38601281dfeb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-jms." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.20.RELEASE-tuxcare.2" } ] }