{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:032b8bec-e87a-59b9-9fee-af2385053ca4", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-oxm", "purl": "pkg:maven/org.springframework/spring-oxm@6.2.3-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-oxm@6.2.3-tuxcare.1", "version": "6.2.3-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-oxm", "purl": "pkg:maven/org.springframework/spring-oxm@6.2.3", "type": "library", "group": "org.springframework", "version": "6.2.3" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:199838f2-7177-59f2-b44c-1747ea5e8af6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 6.2.3-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:9cac634e-ac5e-5e16-acf7-ab99a8f5c6a4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.2.3-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:649d4ae2-a673-5cf2-b604-f575c55972d0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.2.3-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2013-4152", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:4682e89f-cdc6-5e39-8a8c-1e27564c4f67", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-4152 affects version 6.2.3-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2013-7315", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:ae1559ca-81c5-533b-b7ef-b74f9df53877", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-7315 affects version 6.2.3-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:00603a61-8b8d-5eb6-be8d-c0fbfd150c16", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.2.3-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:c819bbbd-efdc-5265-9e33-e68206c562d9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.2.3-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:6a505023-00bc-5bf3-bb1a-4e04523eaf15", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.2.3-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:63e90b94-5827-552a-a9c0-c30cb999be5c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.2.3-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:2b0f2b4a-b8bc-5b1c-88af-834236a11a38", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.2.3-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:9134e911-2b58-5c07-83cf-bd7b906636b4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.2.3-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:44259949-387c-58b5-b2ea-24962f0c2fb0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.2.3-tuxcare.1 of org.springframework:spring-oxm. not_affected \u2014 CVE-2018-1257 does not affect Spring Framework 6.2.3. The vulnerability involved unchecked parsing of attacker-controlled Spring EL expressions from STOMP subscription selector headers, leading to potential DoS through regex/expression complexity. The upstream fix (commit ff2228fdaf, April 2018) added the ability to disable selector header support via setSelectorHeaderName(null). A subsequent h...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:4b0c2f96-ff2d-557b-90cd-55464f4d1976", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.2.3-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:11abcb7f-e40b-5f64-ae26-f04e059eb0f0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.2.3-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:b6da4f5d-e0e0-5aa3-9bdc-7abc4add5c5d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.2.3-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:d242722f-3bf7-56a7-8885-cc2a7c4f0cf9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.2.3-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:08933802-c800-5f86-a4fb-55985f2d746b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.2.3-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:36aa1e34-c155-50ff-9a2a-c5b6ad6b8b89", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.2.3-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:91cf45f4-9b8a-5531-89fc-7cb19dbc8ec5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.2.3-tuxcare.1 of org.springframework:spring-oxm. Spring Framework 6.2.3 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:50ee9dc8-64c8-5890-bed8-b2a83b2f82fa", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.2.3-tuxcare.1 of org.springframework:spring-oxm. not_affected \u2014 Spring Framework 6.2.3 is not affected by CVE-2022-22970. The vulnerability was fixed in upstream versions 5.3.20+ and 5.2.22+ (released May 2022). Version 6.2.3 is significantly newer and includes the complete fix in the upstream release. The fix filters dangerous read-only properties (AutoCloseable, ClassLoader, ProtectionDomain) and specifically blocks URL.content from JavaBeans introspectio...", "justification": "code_not_present" } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:691067f8-09ff-5f83-843e-7d8b493a99d9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.2.3-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:3dd59f32-53a3-543d-9439-a203603b013e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:df0361c2-768b-5987-bc9f-532caf357803", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 6.2.3-tuxcare.1 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:517ce67f-68a8-596c-b0dd-6d38256f3232", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-oxm." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-oxm@6.2.3-tuxcare.1" } ] }