{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:884aef32-4e73-505c-8c68-bf64e2d4d874", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-orm", "purl": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.11", "version": "6.0.23-tuxcare.11", "pedigree": { "ancestors": [ { "name": "spring-orm", "purl": "pkg:maven/org.springframework/spring-orm@6.0.23", "type": "library", "group": "org.springframework", "version": "6.0.23" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:b8ee23db-5006-54f2-ae07-48b929bc9896", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 6.0.23-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:d0b2b905-703b-5db3-b298-beab6a77c762", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.0.23-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:d24d2ad9-ca41-5dcb-8774-593390c90063", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.0.23-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:522d6eb8-c671-53a2-b28e-944932855ece", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.0.23-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:1b70b23b-f954-5f1e-a013-58d5321d3292", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.0.23-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:2d56b721-5868-522f-9510-16da890ee93d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.0.23-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:32944593-200b-58e7-b135-e6ad72277575", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.0.23-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:7b19f5c6-c837-50d3-8dc2-14cea68ca26c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.0.23-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:c8d8277c-511f-58cf-914c-71e96ad60c79", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.0.23-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:98d76cd0-cbb7-52fd-b0fd-6151c941095a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.0.23-tuxcare.11 of org.springframework:spring-orm. not_affected \u2014 CVE-2018-1257 affects Spring Framework versions with unconditional STOMP selector header parsing vulnerable to ReDoS. The target (6.0.23) contains the upstream fix from commit ff2228fdaf by rstoyanchev@pivotal.io that adds the ability to disable selector parsing via setSelectorHeaderName(null) and guards parsing with a null check. This fix was already present in the upstream Spring Framework 6....", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:1a1f20f9-4a27-5db5-aec8-8f5b5a2e41ca", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.0.23-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:be96b544-757c-5710-a390-04e6f2eeba53", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.0.23-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:01654c91-8058-5240-9f29-eba6bd576f50", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.0.23-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:9b96a6e2-ad55-5830-b2da-68a6c0265861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.0.23-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:c44a1db6-e969-58da-bf0f-a621f89b57f9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.0.23-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:6b11351e-0b20-5f9d-a6b3-f266923b425e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.0.23-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:1b78ef38-cd3d-5133-a20e-a31278abcfb5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.0.23-tuxcare.11 of org.springframework:spring-orm. Spring Framework 6.0.23 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:9032e41d-1685-5e34-9aa2-2dc93a9aee14", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.0.23-tuxcare.11 of org.springframework:spring-orm. not_affected \u2014 CVE-2022-22970 is NOT present in Spring Framework 6.0.23. The vulnerability allowed DoS through resource exhaustion when data binding MultipartFile/Part objects, caused by introspection of read-only properties with dangerous types (AutoCloseable, ClassLoader). The upstream fix was already included in the 6.0.23 release, introduced by Juergen Hoeller in commit 83186b689f11f5e6efe7ccc08fdeb92f66f...", "justification": "code_not_present" } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:42ab0fe8-885d-5079-b584-bd5af8e0cb1e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.0.23-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:79d5b65b-a3b6-5139-b654-3d9c85f31abe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:8f165bcc-6c15-5794-9197-231d42d72ffa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:8144d380-cec0-56f5-83f0-776749468804", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-orm." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.0.23-tuxcare.11" } ] }