{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:393d326b-b4cd-5417-8225-e902ce6e68cf", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-orm", "purl": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.10", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.10", "version": "6.0.23-tuxcare.10", "pedigree": { "ancestors": [ { "name": "spring-orm", "purl": "pkg:maven/org.springframework/spring-orm@6.0.23", "type": "library", "group": "org.springframework", "version": "6.0.23" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:94d871bb-06f9-5cc6-b9ba-ee37b5cf22b7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 6.0.23-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:33af17ea-bde5-5f8e-84f4-dfb8c7b6a0b4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.0.23-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:21229fd9-e028-5db7-9de9-d1e7d5119a22", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.0.23-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:b985cfa5-d45a-5802-a4f7-773d61fb49f1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.0.23-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:d7c9314d-5381-56ac-8a8f-b0c5d2db232e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.0.23-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:57c14fae-379a-538a-9ab8-0195ac4261b9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.0.23-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:a764a38e-3d4a-5bee-84d3-d2b6ab9f633d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.0.23-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:9d7474ed-8376-57f5-a9dc-5c0987502706", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.0.23-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:b0b281f6-99b8-5b5f-80f9-a81a9626de3f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.0.23-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:ca0e248a-f435-5d14-ae05-6c023fe680a4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.0.23-tuxcare.10 of org.springframework:spring-orm. not_affected \u2014 CVE-2018-1257 affects Spring Framework versions with unconditional STOMP selector header parsing vulnerable to ReDoS. The target (6.0.23) contains the upstream fix from commit ff2228fdaf by rstoyanchev@pivotal.io that adds the ability to disable selector parsing via setSelectorHeaderName(null) and guards parsing with a null check. This fix was already present in the upstream Spring Framework 6....", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:b533bd46-17e1-5f13-8e53-3bdf0cb96429", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.0.23-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:f01fa91c-5745-5eba-95f3-98736c4d614e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.0.23-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:591bc34d-2752-5aed-be07-e8387708a4a8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.0.23-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:7d997092-da95-59ae-9c5b-3aa8e3568f50", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.0.23-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:d4df1aa7-849d-5339-a0a3-3e409dede621", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.0.23-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:02750f8d-10ac-5868-b36e-b3e14d592691", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.0.23-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:ee9a7c59-3482-5e26-b676-6964b7c7e87c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.0.23-tuxcare.10 of org.springframework:spring-orm. Spring Framework 6.0.23 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:de241089-14da-5b7e-987c-1eaefef100f1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.0.23-tuxcare.10 of org.springframework:spring-orm. not_affected \u2014 CVE-2022-22970 is NOT present in Spring Framework 6.0.23. The vulnerability allowed DoS through resource exhaustion when data binding MultipartFile/Part objects, caused by introspection of read-only properties with dangerous types (AutoCloseable, ClassLoader). The upstream fix was already included in the 6.0.23 release, introduced by Juergen Hoeller in commit 83186b689f11f5e6efe7ccc08fdeb92f66f...", "justification": "code_not_present" } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:77ff833b-c295-5a87-8304-ade6c89112a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.0.23-tuxcare.10 of org.springframework:spring-orm." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:5aeb7fa3-c888-53e7-a57a-9a1b2b083dea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 6.0.23-tuxcare.10 of org.springframework:spring-orm, and is fixed in 6.0.23-tuxcare.11." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:80aaf671-2784-5764-a329-84206c7f911b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 6.0.23-tuxcare.10 of org.springframework:spring-orm, and is fixed in 6.0.23-tuxcare.11." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:940c2e40-98ab-5052-8d2a-7abffddfe405", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.23-tuxcare.10 of org.springframework:spring-orm." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.10" } ] }