{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2aab73ca-b00d-534a-bff7-d4957a5404be", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-tx", "purl": "pkg:maven/org.springframework/spring-tx@6.0.23-tuxcare.12", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-tx@6.0.23-tuxcare.12", "version": "6.0.23-tuxcare.12", "pedigree": { "ancestors": [ { "name": "spring-tx", "purl": "pkg:maven/org.springframework/spring-tx@6.0.23", "type": "library", "group": "org.springframework", "version": "6.0.23" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:74ae8818-c53a-5504-8b7a-356058919070", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 6.0.23-tuxcare.12 of org.springframework:spring-tx." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:18d25c33-2925-5671-8e97-fb8222d1e547", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.0.23-tuxcare.12 of org.springframework:spring-tx." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:4361a7a8-9e50-5b58-8960-709c41763e5f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.0.23-tuxcare.12 of org.springframework:spring-tx." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:d2f8d0b6-ebf9-5c82-86a6-ad4aa8d98481", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.0.23-tuxcare.12 of org.springframework:spring-tx." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:d41b2cc2-bbf7-5c01-9af3-2044e6addf3a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.0.23-tuxcare.12 of org.springframework:spring-tx." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:6d1f39f9-51a9-574f-9e89-557a7b044512", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.0.23-tuxcare.12 of org.springframework:spring-tx." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:7f7e18f1-a73e-5014-9e5d-ffb796d2da73", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.0.23-tuxcare.12 of org.springframework:spring-tx." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:1357783f-ba9c-59fc-b99c-be7a3d1391e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.0.23-tuxcare.12 of org.springframework:spring-tx." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:1c4a8c2e-8b5f-5146-9289-a99bf8381471", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.0.23-tuxcare.12 of org.springframework:spring-tx." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:224071c6-c0c8-57cc-9803-362b5811478e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.0.23-tuxcare.12 of org.springframework:spring-tx. not_affected \u2014 CVE-2018-1257 affects Spring Framework versions with unconditional STOMP selector header parsing vulnerable to ReDoS. The target (6.0.23) contains the upstream fix from commit ff2228fdaf by rstoyanchev@pivotal.io that adds the ability to disable selector parsing via setSelectorHeaderName(null) and guards parsing with a null check. This fix was already present in the upstream Spring Framework 6....", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:64ba9b43-c231-57f2-96b2-c7d51bdae78f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.0.23-tuxcare.12 of org.springframework:spring-tx." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:b8f2fbeb-dfd2-575e-b984-b2b0a26b2bfe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.0.23-tuxcare.12 of org.springframework:spring-tx." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:50979e91-8806-59cc-a036-7b5044f4908b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.0.23-tuxcare.12 of org.springframework:spring-tx." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:c15c32cd-18cd-5365-a33d-4bbdf3ab70c7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.0.23-tuxcare.12 of org.springframework:spring-tx." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:b12b335f-46f5-5652-ac14-242bc0ecdda2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.0.23-tuxcare.12 of org.springframework:spring-tx." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:f1f513f7-6a79-5236-a49e-6b4205b45847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.0.23-tuxcare.12 of org.springframework:spring-tx." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:aac27a4e-14f3-5adb-876d-7e27c9099ca2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.0.23-tuxcare.12 of org.springframework:spring-tx. Spring Framework 6.0.23 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:ddded4a8-6e96-5340-b8b6-06e3739f72a2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.0.23-tuxcare.12 of org.springframework:spring-tx. not_affected \u2014 CVE-2022-22970 is NOT present in Spring Framework 6.0.23. The vulnerability allowed DoS through resource exhaustion when data binding MultipartFile/Part objects, caused by introspection of read-only properties with dangerous types (AutoCloseable, ClassLoader). The upstream fix was already included in the 6.0.23 release, introduced by Juergen Hoeller in commit 83186b689f11f5e6efe7ccc08fdeb92f66f...", "justification": "code_not_present" } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:04534f32-fd74-5326-b98b-936c21ce5cb0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.0.23-tuxcare.12 of org.springframework:spring-tx." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:5b03eede-a864-5a90-b2a6-9fa0da3af8a1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:0c04acc7-9401-5d31-9d0f-11b034ad6071", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-tx." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:62e5361c-926f-59b2-bbff-7a8526f33d43", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-tx." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.0.23-tuxcare.12" } ] }