{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f8c697b7-867d-51a7-b7f7-bcc1708b5762", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.1", "version": "6.2.3-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@6.2.3", "type": "library", "group": "org.springframework", "version": "6.2.3" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:54d0d0b9-4145-505f-afb8-74d998db2101", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 6.2.3-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:f61fc5f8-60e9-5395-9168-3953588d1545", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.2.3-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:f8cc2e5e-3675-5ed1-bd53-104d5f6ed11a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.2.3-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:ae39127c-e77f-50cc-a3b8-095737cc9027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.2.3-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:1420d140-8b2c-5488-a6a8-bab1c8da218d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.2.3-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:397aa2d6-d39d-58e6-a601-53440925dbda", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.2.3-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:1580c739-14ce-5c51-8011-bf702714a150", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.2.3-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:cb243763-f7d5-55ee-8bce-4fc2d122fc1d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.2.3-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:269f22c6-2f98-58ae-bdac-3b1fc23417ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.2.3-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:2a3bd860-8a1e-5177-a882-e65aa555f64f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.2.3-tuxcare.1 of org.springframework:spring-jms. not_affected \u2014 CVE-2018-1257 does not affect Spring Framework 6.2.3. The vulnerability involved unchecked parsing of attacker-controlled Spring EL expressions from STOMP subscription selector headers, leading to potential DoS through regex/expression complexity. The upstream fix (commit ff2228fdaf, April 2018) added the ability to disable selector header support via setSelectorHeaderName(null). A subsequent h...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:83f2f75c-5f6d-547e-a2c4-e9cf28fe4880", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.2.3-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1270", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:27b2f579-4021-53e1-8d4e-6a9c7bff61a2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1270 affects version 6.2.3-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:608fc160-57a0-50ef-9027-045562234c96", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.2.3-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:d1029003-c30c-5f30-943c-fd7bb18c6d36", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.2.3-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1275", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:8ffc6b33-3c76-51bb-9985-a169d33a31f6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1275 affects version 6.2.3-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:8a0a4090-b26a-5b02-8658-08a77781b903", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.2.3-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:83c1c5f2-acef-53d5-95e6-8757fd5e756d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.2.3-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:7cfadf29-02d6-5825-b8ac-f90b88bc1b15", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.2.3-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:df641bcc-bf15-543f-940d-0e3eac7cfeb9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.2.3-tuxcare.1 of org.springframework:spring-jms. Spring Framework 6.2.3 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:c73395ba-a660-5a8b-862d-255142096572", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.2.3-tuxcare.1 of org.springframework:spring-jms. not_affected \u2014 Spring Framework 6.2.3 is not affected by CVE-2022-22970. The vulnerability was fixed in upstream versions 5.3.20+ and 5.2.22+ (released May 2022). Version 6.2.3 is significantly newer and includes the complete fix in the upstream release. The fix filters dangerous read-only properties (AutoCloseable, ClassLoader, ProtectionDomain) and specifically blocks URL.content from JavaBeans introspectio...", "justification": "code_not_present" } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:9869fbf6-3927-5447-a9f4-8758da564d2b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22971 affects version 6.2.3-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:d668c886-cd9f-555e-8218-2b534212ac35", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.2.3-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:d422bfc3-f4bb-5149-b6d5-743c03a627ba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:0eaa696a-5bca-5432-8139-4bc3bf2dd3ea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 6.2.3-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:b122cc9b-949f-52ee-86fc-b9b8ada4f34a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:e1291b8d-a731-50c7-8635-8c88e4587114", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:2954c3da-55bc-5201-a254-076a563df3e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-jms." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.1" } ] }