{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:8b9afbba-3992-5f58-8556-19b6327dc79e",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-orm",
      "purl": "pkg:maven/org.springframework/spring-orm@4.3.20.RELEASE-tuxcare.1",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-orm@4.3.20.RELEASE-tuxcare.1",
      "version": "4.3.20.RELEASE-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-orm",
            "purl": "pkg:maven/org.springframework/spring-orm@4.3.20.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "4.3.20.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2009-1190",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.3.20.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:bb42bd26-0546-5fcb-bc08-76d60641efb8",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2009-1190 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2011-2730",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.3.20.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:fc2d841c-d4ad-5a67-9eec-44195343ad48",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-2730 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2011-2894",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.3.20.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:223d8b15-0d4c-54f0-be64-bf7c607d0fd5",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-2894 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2014-3578",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.3.20.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9099228b-9591-511a-b752-b6eafbd32925",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2014-3578 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2015-0201",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.3.20.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ea3025fa-1c48-5a99-a4eb-13018fadc041",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-0201 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2015-5211",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.3.20.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f24af3db-1f77-5291-8cc1-529932aaf37a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-5211 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2016-5007",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.3.20.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:28642c86-8703-5a98-87e4-9d69ee223757",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-5007 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2018-11040",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.3.20.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:5a647127-205d-5d51-be20-821eb0191d7b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-11040 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2018-1199",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.3.20.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:4e89393d-956c-5a0b-880c-a5cc8dac24ce",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1199 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2018-1257",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.3.20.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d29816f2-7d50-58d2-880d-59f772ea9f83",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1257 does not affect version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-orm. not_affected \u2014 Target version 4.3.20.RELEASE is not affected by CVE-2018-1257. The vulnerability (regex DoS via malicious SpEL expressions in STOMP selector headers) was fixed by upstream Spring Framework in version 4.3.17 through two defensive measures: (1) switching from StandardEvaluationContext to SimpleEvaluationContext to restrict expression capabilities, and (2) adding configuration support to disable ...",
        "justification": "protected_at_runtime"
      }
    },
    {
      "id": "CVE-2018-1258",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.3.20.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:1540ab8f-b1c7-5ab4-89b2-9407d060050b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1258 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2018-1271",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.3.20.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:18ed0c79-9ecc-59a3-9099-81ecd8bdf21e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1271 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2018-1272",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.3.20.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:5e4fa650-4882-5eb0-a854-e418f29d4199",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1272 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2018-15756",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.3.20.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:2eb13deb-26a8-57a6-82af-1ac099812b8c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-15756 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2021-22060",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.3.20.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c41a6e52-9f25-5917-b418-4e91b509dc4a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-22060 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2021-22096",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.3.20.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:7f6702d4-9d71-5de5-b3aa-af2d50cf8132",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2021-22096 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2022-22965",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.3.20.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9330295a-c7e3-585c-affc-3f88d486eafc",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2022-22970",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.3.20.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:6a7b8c4c-78d9-5c47-9d16-d37dc32fd837",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22970 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2024-22233",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.3.20.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0aa44a30-8660-5842-9645-b38ecc383766",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-22233 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2025-41249",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.3.20.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b6260886-dc41-5b7d-bdc1-8c79ba87b385",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2026-41848",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.3.20.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:103ca432-7d3d-5fe7-9122-3845b8371278",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41848 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-orm."
      }
    },
    {
      "id": "CVE-2026-59282",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-orm@4.3.20.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:454fa7a9-e26d-5828-bed0-8ff10300a779",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-orm."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-orm@4.3.20.RELEASE-tuxcare.1"
    }
  ]
}