{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:42f8759a-81fb-5039-a3e3-7506a9ae90a1", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-orm", "purl": "pkg:maven/org.springframework/spring-orm@6.1.16-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-orm@6.1.16-tuxcare.6", "version": "6.1.16-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-orm", "purl": "pkg:maven/org.springframework/spring-orm@6.1.16", "type": "library", "group": "org.springframework", "version": "6.1.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:c66221b0-46f0-5759-88dd-79e826fdd72d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2009-1190 does not affect version 6.1.16-tuxcare.6 of org.springframework:spring-orm. not_affected \u2014 Spring Framework 6.1.16 is not affected by CVE-2009-1190. While the code still contains serializable classes (AbstractRegexpMethodPointcut, JdkRegexpMethodPointcut) that deserialize and compile regex patterns without validation, the underlying vulnerability is a specific algorithmic complexity bug in java.util.regex.Pattern.compile that existed only in JDK versions before 1.6. Spring Framework ...", "justification": "requires_environment" } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:a832f0b3-bd7a-5ea0-bc60-b15f0b31b195", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.1.16-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:cdfe177d-de6d-57a9-968b-a364a9f3b00e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.1.16-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:d2210ea9-551b-53d3-b447-90e2c5d92a12", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.1.16-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:254ada86-da73-5676-b6b6-cf1b2fe31cf4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.1.16-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:86a5f4e5-4312-5fbf-9edc-4ddcd72450cc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.1.16-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:3e62459e-4c2a-5f2b-a23e-92a14e574b0d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.1.16-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:dc379b8e-28d5-58b2-bfc5-59c2505d88d4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.1.16-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:2f88a442-795f-510c-84a0-242264726116", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.1.16-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:8de986b2-38fe-5708-9899-b30f67b406ea", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.1.16-tuxcare.6 of org.springframework:spring-orm. not_affected \u2014 CVE-2018-1257 describes a DoS vulnerability via malicious Spring EL expressions in STOMP subscription selector headers. The target Spring Framework 6.1.16 has an upstream fix (commit 5bc80fc094 by sam@sambrannen.com, June 2023) that disables the SpEL selector feature by default. The selectorHeaderName field defaults to null, and the getSelectorExpression() method checks for null before attempti...", "justification": "protected_at_runtime" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:b72c3bcc-f0de-50fc-a1d0-c6299fe5c6b7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.1.16-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:9417ee0c-e022-5651-afe4-a84d5d935374", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.1.16-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:eec3a953-6851-5a62-9355-a63fc57b6d43", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.1.16-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:832e1476-524c-5303-b5a8-4b740af6eb0f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.1.16-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:df03090a-b6d2-55c0-b179-27d6892b9138", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.1.16-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:8cb4c44f-8681-56eb-926a-7cfc551926ca", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.1.16-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:79b25f75-6ce5-5e08-912a-0310b66681a0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.1.16-tuxcare.6 of org.springframework:spring-orm. Spring Framework 6.1.16 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:4a8426e2-b91e-5187-bbb7-f58e0f8d7128", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.1.16-tuxcare.6 of org.springframework:spring-orm. not_affected \u2014 CVE-2022-22970 is NOT present in Spring Framework 6.1.16. The vulnerability allowed DoS attacks through file upload data binding that triggered repeated property introspection of MultipartFile/Part fields, causing resource exhaustion via unclosed InputStreams. The upstream fix (commit 83186b689f by Juergen Hoeller) blocks introspection of read-only properties returning AutoCloseable types (incl...", "justification": "code_not_present" } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:b472a9ac-6f8c-5c5a-a28f-a25c0b031cfb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.1.16-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:05dc9687-6555-5ef7-9827-86e348997a65", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.1.16-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:ec35f1cb-dfcb-5efb-9916-109b0efd4e33", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.1.16-tuxcare.6 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:4190288c-0ae0-5d36-b649-05815f503af0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.1.16-tuxcare.6 of org.springframework:spring-orm." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.1.16-tuxcare.6" } ] }