{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:614be01b-79fb-5541-bce6-6d5b7e19c93a", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-tx", "purl": "pkg:maven/org.springframework/spring-tx@6.1.4-tuxcare.8", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-tx@6.1.4-tuxcare.8", "version": "6.1.4-tuxcare.8", "pedigree": { "ancestors": [ { "name": "spring-tx", "purl": "pkg:maven/org.springframework/spring-tx@6.1.4", "type": "library", "group": "org.springframework", "version": "6.1.4" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:f37ea820-de9f-522e-94cb-4498e03201f5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2009-1190 does not affect version 6.1.4-tuxcare.8 of org.springframework:spring-tx. not_affected \u2014 Spring Framework 6.1.4 is not affected by CVE-2009-1190. The vulnerability required Java object deserialization from untrusted remote sources to trigger catastrophic backtracking in JDK <1.6's Pattern.compile. Spring Framework 6.1.4 does not expose Java object deserialization via HTTP endpoints (uses JSON/XML/Protobuf instead), has no RMI or remoting features (removed in Spring 5.3+), and only ...", "justification": "code_not_reachable" } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:3bf15ef2-22b2-5058-ac84-35c806e70358", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.1.4-tuxcare.8 of org.springframework:spring-tx." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:78666ffd-88f0-5e6c-a75b-ed3b7bee99b4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.1.4-tuxcare.8 of org.springframework:spring-tx." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:93946c4b-10a0-53b7-850d-a77b3794ad28", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.1.4-tuxcare.8 of org.springframework:spring-tx." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:4cb8cd9d-824f-5537-b1d1-8683b0deb2a7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.1.4-tuxcare.8 of org.springframework:spring-tx." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:87582a59-62d1-5f8e-85ea-062c64c6b1c7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.1.4-tuxcare.8 of org.springframework:spring-tx." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:9a2dafab-70d6-5754-b0fb-bf5a3baaf00b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.1.4-tuxcare.8 of org.springframework:spring-tx." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:9ffae19c-7333-5cdf-b01a-a347f4038f7c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.1.4-tuxcare.8 of org.springframework:spring-tx." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:74fa0e7d-7bab-57ff-9fa7-bfb92e593237", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.1.4-tuxcare.8 of org.springframework:spring-tx." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:d437ddf3-48ef-592b-95b6-1d1b8b832733", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.1.4-tuxcare.8 of org.springframework:spring-tx. not_affected \u2014 Spring Framework 6.1.4 is not affected by CVE-2018-1257. The vulnerability (DoS via malicious STOMP selector header causing regex/expression parsing exhaustion) was fixed in upstream Spring Framework 4.3.17 and 5.0.6 (April 2018). The fix - a null-check that skips selector expression parsing when the feature is disabled - is present in version 6.1.4. Additionally, as of Spring Framework 6.1, th...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:ed3c9ac7-92ef-5ad4-98ce-8c0d9566a967", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.1.4-tuxcare.8 of org.springframework:spring-tx." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:37a243af-743f-50b8-b84c-6480453c4da1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.1.4-tuxcare.8 of org.springframework:spring-tx." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:7c772b42-3900-50cb-97bf-20a65d35cac7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.1.4-tuxcare.8 of org.springframework:spring-tx." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:9f539c16-3c82-5034-bc58-288c4091cb88", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.1.4-tuxcare.8 of org.springframework:spring-tx." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:be002a26-694d-54a4-8496-e93c9653d440", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.1.4-tuxcare.8 of org.springframework:spring-tx." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:a1475b3f-158a-51f7-a6b5-169ebec15968", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.1.4-tuxcare.8 of org.springframework:spring-tx." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:35e0d718-7863-596c-8723-35f2af74b0ac", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.1.4-tuxcare.8 of org.springframework:spring-tx. Spring Framework 6.1.4 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:daf4a89e-602a-53ca-9e8b-bac1290b2a94", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.1.4-tuxcare.8 of org.springframework:spring-tx. not_affected \u2014 Spring Framework 6.1.4 is not affected by CVE-2022-22970. The fix was already present in the upstream Spring Framework 6.1.4 release that TuxCare onboarded. The vulnerability (DoS via data binding to dangerous read-only properties like AutoCloseable types and URL.content) was addressed in upstream commit 83186b689f11f5e6efe7ccc08fdeb92f66fcd583 by Juergen Hoeller on May 11, 2022, well before ve...", "justification": "code_not_present" } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:3f751767-84ff-5660-825f-9d332da9485b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.1.4-tuxcare.8 of org.springframework:spring-tx." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:b0257397-ade3-5bac-ad4e-0d5aee9d2e26", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.1.4-tuxcare.8 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:7498018e-18b2-5c81-a08e-7e2e2413e449", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.1.4-tuxcare.8 of org.springframework:spring-tx." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:4f37e671-fafc-53f1-9b63-5d52db4359ee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.1.4-tuxcare.8 of org.springframework:spring-tx." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-tx@6.1.4-tuxcare.8" } ] }