{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:b4047e1c-6abe-5bf2-81e9-4c5c964b7dc2", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "framework", "purl": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare", "type": "library", "group": "laravel", "bom-ref": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare", "version": "5.7.29-p4+tuxcare", "pedigree": { "ancestors": [ { "name": "framework", "purl": "pkg:composer/laravel/framework@5.7.29", "type": "library", "group": "laravel", "version": "5.7.29" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2017-14775", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } ], "bom-ref": "urn:uuid:09a13c9c-e5f5-5c5a-8fd6-a91384c34461", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-14775 does not affect version 5.7.29-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.7.29 is not affected by CVE-2017-14775. The vulnerability affected Laravel versions before 5.5.10 due to non-constant-time token comparison in remember_me authentication. Version 5.7.29 was released after the fix (5.5.10) and contains the upstream security patch that replaced database-level string comparison with hash_equals() constant-time comparison in both DatabaseUserProvider and ...", "justification": "code_not_present" } }, { "id": "CVE-2018-15133", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } ], "bom-ref": "urn:uuid:6ab97071-9a24-5efb-a299-6afa47b31c7e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15133 affects version 5.7.29-p4+tuxcare of laravel/framework." } }, { "id": "CVE-2019-9081", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } ], "bom-ref": "urn:uuid:b50b85dc-7fea-59e1-84e9-724ece33a9f1", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2019-9081 is a false positive for laravel/framework 5.7.29-p4+tuxcare. CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19)." } }, { "id": "CVE-2020-19316", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } ], "bom-ref": "urn:uuid:336571c6-0210-51bf-ba07-752cfecec880", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-19316 is fixed in version 5.7.29-p4+tuxcare of laravel/framework." } }, { "id": "CVE-2020-24941", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } ], "bom-ref": "urn:uuid:a5955894-da03-55e0-8f36-f32acd9aae4c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-24941 is fixed in version 5.7.29-p4+tuxcare of laravel/framework." } }, { "id": "CVE-2021-21263", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } ], "bom-ref": "urn:uuid:267c1a0a-7afb-5b31-8529-1a51ac340a88", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-21263 is fixed in version 5.7.29-p4+tuxcare of laravel/framework." } }, { "id": "CVE-2021-43503", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } ], "bom-ref": "urn:uuid:c9b1a3b1-a2cc-5849-b07a-a6f0cab5435e", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2021-43503 is a false positive for laravel/framework 5.7.29-p4+tuxcare. CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed." } }, { "id": "CVE-2021-43617", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } ], "bom-ref": "urn:uuid:e2bae163-f2f3-5669-89ba-79474b25190f", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.7.29-p4+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" } }, { "id": "CVE-2021-43808", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } ], "bom-ref": "urn:uuid:e4d4d750-ff8b-554d-8c76-866bacba8d27", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-43808 is fixed in version 5.7.29-p4+tuxcare of laravel/framework." } }, { "id": "CVE-2022-31279", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } ], "bom-ref": "urn:uuid:b5ea63a2-80e4-577c-9f14-f5a52b0f5fb5", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 5.7.29-p4+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" } }, { "id": "CVE-2024-52301", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } ], "bom-ref": "urn:uuid:f4c2474e-5c8b-56a5-a8f1-f7397ac6c399", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52301 is fixed in version 5.7.29-p4+tuxcare of laravel/framework." } }, { "id": "CVE-2025-27515", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } ], "bom-ref": "urn:uuid:fd768ecc-57a3-5988-ac64-a2cc6aeb72c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27515 is fixed in version 5.7.29-p4+tuxcare of laravel/framework." } }, { "id": "CVE-2026-102279", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } ], "bom-ref": "urn:uuid:f1cefe72-090b-51b1-b0a9-63f78567ed47", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-102279 does not affect version 5.7.29-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework version 5.7.29 is not affected by CVE-2026-102279. This version uses the Whoops library for debug exception rendering, not Laravel's custom exception renderer with Tippy.js tooltips. The vulnerable code path (Tippy.js initialization with `allowHTML: true` for `data-tippy-content` elements) does not exist in version 5.7.29. The custom Laravel exception renderer was introduced i...", "justification": "code_not_present" } }, { "id": "CVE-2026-114508", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } ], "bom-ref": "urn:uuid:d8645da0-2ede-5352-95f6-4926203d70c1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-114508 does not affect version 5.7.29-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.7.29 is not affected by CVE-2026-114508. The vulnerability exists in the JSON:API resources feature, which was introduced in Laravel 12.x (December 2025). Laravel 5.7.29 predates this feature by approximately 6 years and 5+ major versions. The target version contains only the older Json resources (not JsonApi) which do not process relationship inclusion parameters from URLs, making th...", "justification": "code_not_present" } }, { "id": "CVE-2026-114509", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } ], "bom-ref": "urn:uuid:ba51cba1-27c3-5e45-86c4-2da337ea24a3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114509 affects version 5.7.29-p4+tuxcare of laravel/framework." } }, { "id": "GHSA-4mg9-vhxq-vm7j", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } ], "bom-ref": "urn:uuid:eb5f880c-8921-5388-8519-f5438bc3f406", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.7.29-p4+tuxcare of laravel/framework." } }, { "id": "GHSA-5vg9-5847-vvmq", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } ], "bom-ref": "urn:uuid:377aa0ad-94ee-5d60-a267-48927d122fee", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-5vg9-5847-vvmq does not affect version 5.7.29-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.7.29 uses SwiftMailer, not Symfony Mailer. The GHSA-5vg9-5847-vvmq vulnerability specifically requires Symfony Mailer's handling of CRLF sequences. SwiftMailer employs EmailValidator which rejects CRLF in email addresses, breaking the attack chain.", "justification": "protected_at_runtime" } }, { "id": "GHSA-6jvx-8ch9-j2jr", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } ], "bom-ref": "urn:uuid:b18c94b3-0afa-50c3-9528-71c738252038", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 5.7.29-p4+tuxcare of laravel/framework. not_affected \u2014 Target repository Laravel 5.7.29-p4+tuxcare is not affected by GHSA-6jvx-8ch9-j2jr (cookie deserialization vulnerability). The fix for this vulnerability was already present in the upstream Laravel 5.7.29 release (September 2018), which shipped after the vulnerability was fixed in Laravel 5.6.30 (August 2018). The target's cookie encryption middleware disables serialization for all cookies via ...", "justification": "code_not_present" } }, { "id": "GHSA-7852-w36x-6mf6", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } ], "bom-ref": "urn:uuid:2bb1a4e0-a1d0-54e6-bcba-db1fa025cae2", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 5.7.29-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 5.7.29 code is not affected by GHSA-7852-w36x-6mf6. The IV length validation fix (checking that base64-decoded IV length matches openssl_cipher_iv_length) is already present in the Encrypter.php validPayload() method at line 210. This fix was included in the upstream Laravel 5.7.29 release (authored by Taylor Otwell in March 2018, before Laravel 5.7 was released in September ...", "justification": "code_not_present" } }, { "id": "GHSA-crmm-hgp2-wgrp", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } ], "bom-ref": "urn:uuid:7e7989ef-f25c-579b-8afb-00a5922d914c", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.7.29-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.7.29 does not support temporary signed URLs for local filesystem storage. The vulnerable feature (LocalFilesystemAdapter with temporaryUrl/temporaryUploadUrl methods) does not exist in this version. The FilesystemAdapter::temporaryUrl() method explicitly throws RuntimeException when used with LocalAdapter.", "justification": "code_not_present" } }, { "id": "GHSA-jwvj-pwww-3mj5", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } ], "bom-ref": "urn:uuid:56fec0a7-f96b-5b60-b005-2ffd7ef36f31", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-jwvj-pwww-3mj5 affects version 5.7.29-p4+tuxcare of laravel/framework." } }, { "id": "GHSA-qm5c-m76r-2hfr", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } ], "bom-ref": "urn:uuid:0df775c2-d41f-58dc-ba31-024d787c9ae3", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.7.29-p4+tuxcare of laravel/framework." } }, { "id": "GHSA-wq8p-mqvg-2p5h", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } ], "bom-ref": "urn:uuid:d75f1a28-4bcd-5140-a10a-641a75a9d7f1", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-wq8p-mqvg-2p5h affects version 5.7.29-p4+tuxcare of laravel/framework." } }, { "id": "GHSA-x7p5-p2c9-phvg", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } ], "bom-ref": "urn:uuid:60c54fd5-4b4e-52b6-939a-8124b5785614", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.7.29-p4+tuxcare of laravel/framework." } } ], "dependencies": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } ] }