{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d298593c-004e-51c5-a6c8-8cfaf5d79cda", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-orm", "purl": "pkg:maven/org.springframework/spring-orm@6.2.3-tuxcare.3", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-orm@6.2.3-tuxcare.3", "version": "6.2.3-tuxcare.3", "pedigree": { "ancestors": [ { "name": "spring-orm", "purl": "pkg:maven/org.springframework/spring-orm@6.2.3", "type": "library", "group": "org.springframework", "version": "6.2.3" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:3c8993af-76eb-51ca-add3-7eb42241e1ae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 6.2.3-tuxcare.3 of org.springframework:spring-orm." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:99f67316-1242-53df-9af3-bf43455212af", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.2.3-tuxcare.3 of org.springframework:spring-orm." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:2e705cf2-4790-5711-be3b-e9c79f84b55e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.2.3-tuxcare.3 of org.springframework:spring-orm." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:e14df4d2-d79e-514c-a948-68c666fe1eba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.2.3-tuxcare.3 of org.springframework:spring-orm." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:85f71f95-b589-5312-ad24-50201742a6c2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.2.3-tuxcare.3 of org.springframework:spring-orm." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:400a8c76-d559-5c83-b46c-3c143a379e56", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.2.3-tuxcare.3 of org.springframework:spring-orm." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:3e504fae-af58-5210-96fb-4f2cce9aa387", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.2.3-tuxcare.3 of org.springframework:spring-orm." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:6ad2f9d7-8882-5a4b-8167-cf71d9a02cc9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.2.3-tuxcare.3 of org.springframework:spring-orm." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:12bf998c-2246-5834-b890-36f441b2a937", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.2.3-tuxcare.3 of org.springframework:spring-orm." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:e9758b52-0815-58dd-a8a9-ba18b931007e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.2.3-tuxcare.3 of org.springframework:spring-orm. not_affected \u2014 CVE-2018-1257 does not affect Spring Framework 6.2.3. The vulnerability involved unchecked parsing of attacker-controlled Spring EL expressions from STOMP subscription selector headers, leading to potential DoS through regex/expression complexity. The upstream fix (commit ff2228fdaf, April 2018) added the ability to disable selector header support via setSelectorHeaderName(null). A subsequent h...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:b3af6baa-1706-5cad-98dc-420f0d5dac5e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.2.3-tuxcare.3 of org.springframework:spring-orm." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:7c8100a3-3365-53d2-9f55-54b0012b3a93", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.2.3-tuxcare.3 of org.springframework:spring-orm." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:a160854e-8b14-5431-b46e-67f92d385479", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.2.3-tuxcare.3 of org.springframework:spring-orm." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:236f67bd-91e3-56e3-8d3e-dbc5f86b94c0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.2.3-tuxcare.3 of org.springframework:spring-orm." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:91640550-055d-5fa4-8004-20435ade54a9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.2.3-tuxcare.3 of org.springframework:spring-orm." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:06232a2d-0ad3-5bad-b02a-98d5c680eb29", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.2.3-tuxcare.3 of org.springframework:spring-orm." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:5e91eb56-6eda-5a6f-8493-c28f5cecb8bd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.2.3-tuxcare.3 of org.springframework:spring-orm. Spring Framework 6.2.3 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:ae51f327-f42e-5545-a54a-cbeafb35ae49", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.2.3-tuxcare.3 of org.springframework:spring-orm. not_affected \u2014 Spring Framework 6.2.3 is not affected by CVE-2022-22970. The vulnerability was fixed in upstream versions 5.3.20+ and 5.2.22+ (released May 2022). Version 6.2.3 is significantly newer and includes the complete fix in the upstream release. The fix filters dangerous read-only properties (AutoCloseable, ClassLoader, ProtectionDomain) and specifically blocks URL.content from JavaBeans introspectio...", "justification": "code_not_present" } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:68c69aeb-32f5-5fc6-a85a-129d54d865a3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.2.3-tuxcare.3 of org.springframework:spring-orm." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:b9076187-d766-5b47-9465-09ad95477d76", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.2.3-tuxcare.3 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:4049251d-b672-5c3f-9014-b2295d7c3938", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 6.2.3-tuxcare.3 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:3f46518b-2da5-590b-bec7-4f3317737a66", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.2.3-tuxcare.3 of org.springframework:spring-orm." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-orm@6.2.3-tuxcare.3" } ] }