{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7a058035-8abb-5b02-9316-816cfbe88b14", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.8", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.8", "version": "6.1.4-tuxcare.8", "pedigree": { "ancestors": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@6.1.4", "type": "library", "group": "org.springframework", "version": "6.1.4" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:fe96cdbe-3e13-505d-a92d-0b5945916039", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 6.1.4-tuxcare.8 of org.springframework:spring-jms." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:38597b17-f38a-5c0c-9e5b-c779510b081c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.1.4-tuxcare.8 of org.springframework:spring-jms." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:a2c1868f-14db-5657-a585-12039103109e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.1.4-tuxcare.8 of org.springframework:spring-jms." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:605a83be-a95d-56aa-b674-a26aea1d8be9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.1.4-tuxcare.8 of org.springframework:spring-jms." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:f8d42ea1-358b-594d-988d-79cce776ce54", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.1.4-tuxcare.8 of org.springframework:spring-jms." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:d1cdc929-e14b-51e8-a966-f64eee61287e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.1.4-tuxcare.8 of org.springframework:spring-jms." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:468f99f5-d9af-59ff-a050-fa5d407199dd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.1.4-tuxcare.8 of org.springframework:spring-jms." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:7c7d06a2-f3d3-5cea-ab90-a9a164afc24c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.1.4-tuxcare.8 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:99c63b75-5cda-57b7-bf95-1e155128fb6b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.1.4-tuxcare.8 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:1bf8bef6-1945-54db-88d2-d2bcd7242901", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.1.4-tuxcare.8 of org.springframework:spring-jms. not_affected \u2014 Spring Framework 6.1.4 is not affected by CVE-2018-1257. The vulnerability (DoS via malicious STOMP selector header causing regex/expression parsing exhaustion) was fixed in upstream Spring Framework 4.3.17 and 5.0.6 (April 2018). The fix - a null-check that skips selector expression parsing when the feature is disabled - is present in version 6.1.4. Additionally, as of Spring Framework 6.1, th...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:c1fbe384-4a3d-5734-a483-9866bd2d0b9a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.1.4-tuxcare.8 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1270", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:f0932358-b912-5602-81d9-229246ad36e7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1270 affects version 6.1.4-tuxcare.8 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:c7568122-ffca-518e-aea1-1b48531d77a0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.1.4-tuxcare.8 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:0544b707-4c85-5b10-a8c7-91ccc5cfc31f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.1.4-tuxcare.8 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1275", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:4e5c70a1-b433-5e78-a120-3e221b55955b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1275 affects version 6.1.4-tuxcare.8 of org.springframework:spring-jms." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:e60d42b1-fc2d-5a3e-9fad-2f6f9e7d6257", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.1.4-tuxcare.8 of org.springframework:spring-jms." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:ea88d683-8102-5b1d-a705-70c49b73cdf7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.1.4-tuxcare.8 of org.springframework:spring-jms." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:a2afbc10-2bfb-5d8a-9396-b1fef9220444", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.1.4-tuxcare.8 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:488b5e6c-d577-5036-9c6e-65dc9a85a979", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.1.4-tuxcare.8 of org.springframework:spring-jms. Spring Framework 6.1.4 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:b379f790-edbd-561e-a30b-77ffa4cd5e61", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.1.4-tuxcare.8 of org.springframework:spring-jms. not_affected \u2014 Spring Framework 6.1.4 is not affected by CVE-2022-22970. The fix was already present in the upstream Spring Framework 6.1.4 release that TuxCare onboarded. The vulnerability (DoS via data binding to dangerous read-only properties like AutoCloseable types and URL.content) was addressed in upstream commit 83186b689f11f5e6efe7ccc08fdeb92f66fcd583 by Juergen Hoeller on May 11, 2022, well before ve...", "justification": "code_not_present" } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:34707fdb-b9bf-5e91-9135-0909ffeb40b9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22971 affects version 6.1.4-tuxcare.8 of org.springframework:spring-jms." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:c837b98f-cb07-5579-a741-860563785098", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.1.4-tuxcare.8 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:f5090ede-e6d3-519c-ba84-f2747665195c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.1.4-tuxcare.8 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:4589be3d-a951-5b2e-8bfe-256234ff34eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.1.4-tuxcare.8 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:05e71878-8026-519e-8282-f675034009b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.1.4-tuxcare.8 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:bccf68ff-7f75-50df-979d-6bf5a6127dfd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.1.4-tuxcare.8 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:9373a6c7-3c1d-5c0c-82a9-f721e652a1d5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.1.4-tuxcare.8 of org.springframework:spring-jms." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.8" } ] }