{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:1fa2db53-8aad-5e23-8aa6-4e8c477c1116", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-oxm", "purl": "pkg:maven/org.springframework/spring-oxm@4.0.0.RELEASE-tuxcare.5", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-oxm@4.0.0.RELEASE-tuxcare.5", "version": "4.0.0.RELEASE-tuxcare.5", "pedigree": { "ancestors": [ { "name": "spring-oxm", "purl": "pkg:maven/org.springframework/spring-oxm@4.0.0.RELEASE", "type": "library", "group": "org.springframework", "version": "4.0.0.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.0.0.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:2570da3e-31b4-5f4b-949c-fe6cf24ab561", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2009-1190 does not affect version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-oxm. not_affected \u2014 Spring Framework 4.0.0.RELEASE is not affected by CVE-2009-1190. While the Serializable regex pattern code still exists in AbstractRegexpMethodPointcut and JdkRegexpMethodPointcut, the underlying JDK vulnerability that this CVE exploits was fixed in JDK 1.6+. Spring Framework 4.0.0.RELEASE requires JDK 8 (with sourceCompatibility=1.6), making exploitation impossible. The CVE explicitly identifi...", "justification": "requires_environment" } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.0.0.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:5543a15f-06df-5bf6-9010-ea402e4cd188", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-oxm." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.0.0.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:a0f88da0-d662-5cbf-bff3-de408dbc1dec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-oxm." } }, { "id": "CVE-2013-4152", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.0.0.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:fd4ae2b4-f2e5-56ac-806d-5d47a92d91dd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-4152 affects version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-oxm." } }, { "id": "CVE-2013-7315", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.0.0.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:925a9d02-3af5-5c10-995b-280050d19c16", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-7315 affects version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-oxm." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.0.0.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:df01fb99-3e76-5573-bdc8-9c9d73c46bd2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2014-3578 is fixed in version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-oxm." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.0.0.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:f853f04a-e981-5d41-b505-38a298020c8f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-oxm." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.0.0.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:6187bf3d-94db-556a-8c39-2ea42ecdb1de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2015-5211 is fixed in version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-oxm." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.0.0.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:c2dc6670-6ece-5522-9fba-692b7be02d71", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-5007 is fixed in version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.0.0.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:8919706d-de5a-5392-9fdb-54e4aa1a1fbf", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-11040 does not affect version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-oxm. The vulnerable automatic JSONP handling in MappingJackson2JsonView was introduced in Spring Framework 4.1 and is not present in Spring Framework 4.0.0.RELEASE.", "justification": "code_not_present" } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.0.0.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:0d0482cd-83b7-5451-9200-02a4e9a26ceb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.0.0.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:b6d4a97c-6cac-5e0b-b98a-80f2fc812252", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1257 affects version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.0.0.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:8423a937-319f-55b5-9243-18e4ed88c068", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.0.0.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:34b26140-b1b1-505d-a4b4-f1f7d6bbe2c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.0.0.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:247f9d12-ef77-5b01-be63-6b4c7e4eef85", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.0.0.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:49d689f3-d001-59c2-8a5c-2f94be17b2d7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-oxm." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.0.0.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:10b0ed84-6c07-5266-8379-589a3af4abb9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22060 is fixed in version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-oxm." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.0.0.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:d4818bf1-5235-521a-981e-4d3eee3735d2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-oxm." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.0.0.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:518fabb6-f70a-57f7-8a3c-bd0ffae12803", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-oxm." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.0.0.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:e8fb8b8a-e7d3-552b-9cf4-df5b8df470f4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.0.0.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:0ab9591d-af40-5f68-9d00-7be06bc2ad6d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.0.0.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:2db38e44-d7ed-55d6-b79a-3a339d4bdb45", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.0.0.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:84e0da2d-a705-5034-afbd-3fb26559290d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.0.0.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:a43bda6b-83cf-5e55-8a81-5b4b17f9009f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.0.0.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:68eb31fd-8a49-5f4c-8404-51883ba8cbf7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-oxm." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-oxm@4.0.0.RELEASE-tuxcare.5" } ] }