{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:25aa9415-a3b5-5374-af12-6a69fa5c475d", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.2", "version": "6.2.3-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@6.2.3", "type": "library", "group": "org.springframework", "version": "6.2.3" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:1f92d481-451c-52af-aaaa-3e3a82e6869b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 6.2.3-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:6a64c880-8e02-5977-82d1-44901a3cf3c8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.2.3-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:05f47c89-e9a4-51f8-ae39-56a479b00672", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.2.3-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:2390456e-eb0f-55c0-99a5-db8615e1f112", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.2.3-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:a970ad3a-86b2-573d-abb2-1abb3fc2610f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.2.3-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:adac7283-36df-562e-82a9-a6d835d02f0d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.2.3-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:a0cfa9ef-2a00-52df-b133-a94ca9d2eaf6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.2.3-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:c0816bdb-cc6f-5d89-bef7-2716787958d5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.2.3-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:ce7108c7-86da-5d3e-808b-f562e30d68e9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.2.3-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:245acde1-205f-5e76-9fd1-0cb069fc6b86", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.2.3-tuxcare.2 of org.springframework:spring-jms. not_affected \u2014 CVE-2018-1257 does not affect Spring Framework 6.2.3. The vulnerability involved unchecked parsing of attacker-controlled Spring EL expressions from STOMP subscription selector headers, leading to potential DoS through regex/expression complexity. The upstream fix (commit ff2228fdaf, April 2018) added the ability to disable selector header support via setSelectorHeaderName(null). A subsequent h...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:f64f164c-3862-5da5-9611-06afe108f458", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.2.3-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1270", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:4201cde1-f48d-5ad4-85af-7ff7bd30a2c3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1270 affects version 6.2.3-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:35f30627-58d3-5974-ba92-745ecc1114e2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.2.3-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:f823e3bb-426e-5ea3-9c1d-d23c728395dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.2.3-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1275", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:f54ad80b-2d3d-563e-909b-8b14faed35b7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1275 affects version 6.2.3-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:e8ee2ede-aea2-53eb-9ab2-4a7f06a419a1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.2.3-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:3e57c4a4-0083-5bc9-bcbb-959b9caeaf65", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.2.3-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:a8a8cb3a-84ee-54c4-b934-4698690625ef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.2.3-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:a49f4f88-ec79-5f2c-b5b2-439f804d2dc8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.2.3-tuxcare.2 of org.springframework:spring-jms. Spring Framework 6.2.3 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:fe567b54-5934-5dd9-85b6-9668dd7c893e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.2.3-tuxcare.2 of org.springframework:spring-jms. not_affected \u2014 Spring Framework 6.2.3 is not affected by CVE-2022-22970. The vulnerability was fixed in upstream versions 5.3.20+ and 5.2.22+ (released May 2022). Version 6.2.3 is significantly newer and includes the complete fix in the upstream release. The fix filters dangerous read-only properties (AutoCloseable, ClassLoader, ProtectionDomain) and specifically blocks URL.content from JavaBeans introspectio...", "justification": "code_not_present" } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:45092a3e-e1df-5568-85ab-a41970be534d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22971 affects version 6.2.3-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:0c26948d-7f3d-5c4e-b7fa-2abaecd43fee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.2.3-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:0907cb70-61be-5839-967d-2568afa4964d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.2.3-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:78bfbd62-04b9-5b27-833c-2f7ea1fd3899", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 6.2.3-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:9d97aaf1-b6e9-5e1a-8cb5-2d4f90691307", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.2.3-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:2a86aa7f-349e-5fea-86a0-34b82aac8e89", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.2.3-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:ca63e902-1764-540f-8bd8-f2569dd1a6eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.2.3-tuxcare.2 of org.springframework:spring-jms." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.2.3-tuxcare.2" } ] }