{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:70c2e09e-704f-5592-a85e-79fe190a4e95", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "framework", "purl": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare", "type": "library", "group": "laravel", "bom-ref": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare", "version": "8.12.3-p4+tuxcare", "pedigree": { "ancestors": [ { "name": "framework", "purl": "pkg:composer/laravel/framework@8.12.3", "type": "library", "group": "laravel", "version": "8.12.3" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2017-14775", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } ], "bom-ref": "urn:uuid:b18249cf-86eb-509b-80eb-a118e0d26eb2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-14775 does not affect version 8.12.3-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2017-14775. The vulnerability concerned non-constant-time token comparison in remember_me token verification, which was fixed in Laravel 5.5.10 (September 2017). The target version 8.12.3 (released in 2021) already includes the upstream fix using hash_equals() for constant-time comparison in both DatabaseUserProvider and EloquentUserProvider. The fix came w...", "justification": "code_not_present" } }, { "id": "CVE-2018-15133", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } ], "bom-ref": "urn:uuid:df48300d-da6a-53e2-aa75-7e5a98f8785e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15133 affects version 8.12.3-p4+tuxcare of laravel/framework." } }, { "id": "CVE-2019-9081", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } ], "bom-ref": "urn:uuid:9b7d7ec1-cc0f-5987-b805-c8e9d88750ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-9081 affects version 8.12.3-p4+tuxcare of laravel/framework." } }, { "id": "CVE-2020-19316", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } ], "bom-ref": "urn:uuid:2b600a74-94c8-5d0c-8dea-7f94e30b66f2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-19316 affects version 8.12.3-p4+tuxcare of laravel/framework." } }, { "id": "CVE-2020-24941", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } ], "bom-ref": "urn:uuid:f6163128-45a1-5f80-bc74-362b3b8f69f7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-24941 affects version 8.12.3-p4+tuxcare of laravel/framework." } }, { "id": "CVE-2021-21263", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } ], "bom-ref": "urn:uuid:021de488-b9d4-555f-86fb-69870e14a1fe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-21263 is fixed in version 8.12.3-p4+tuxcare of laravel/framework." } }, { "id": "CVE-2021-43617", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } ], "bom-ref": "urn:uuid:ffaea657-4325-590f-a6d7-3c8bd872cf05", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 8.12.3-p4+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" } }, { "id": "CVE-2021-43808", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } ], "bom-ref": "urn:uuid:0f74fb8d-4ef3-589e-b80e-9971f7e44ae0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-43808 is fixed in version 8.12.3-p4+tuxcare of laravel/framework." } }, { "id": "CVE-2024-52301", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } ], "bom-ref": "urn:uuid:38d0c957-a4e8-55c3-8ed0-db2e33038985", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52301 is fixed in version 8.12.3-p4+tuxcare of laravel/framework." } }, { "id": "CVE-2025-27515", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } ], "bom-ref": "urn:uuid:c8e9f775-a1dc-5935-8fa5-fbe977ca6c26", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27515 is fixed in version 8.12.3-p4+tuxcare of laravel/framework." } }, { "id": "CVE-2026-102279", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } ], "bom-ref": "urn:uuid:02d7bafa-fe51-5e9f-9ed8-e62fe7600c06", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-102279 does not affect version 8.12.3-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-102279. The vulnerability requires Laravel's modern exception renderer with Tippy.js tooltips (introduced in Laravel 11+), which does not exist in Laravel 8.12.3. This version uses the Whoops library (filp/whoops) for debug mode exception rendering and simple static HTML templates for error pages. No Tippy.js dependency, no interactive tooltips, and no...", "justification": "code_not_present" } }, { "id": "CVE-2026-114508", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } ], "bom-ref": "urn:uuid:7bc5418b-251a-524c-a21b-a561c465dadb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-114508 does not affect version 8.12.3-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 is not affected by CVE-2026-114508. The vulnerable JsonApi resources feature was introduced in Laravel 12.45.0, approximately 4 major versions after the target version. The entire JsonApi resources module, including the ResolvesJsonApiElements trait and sparseIncluded() method processing, does not exist in Laravel 8.x. The vulnerability requires processing HTTP query parameters w...", "justification": "code_not_present" } }, { "id": "CVE-2026-114509", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } ], "bom-ref": "urn:uuid:ae40486e-1f0d-5d7c-9176-311e3c730a4e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114509 affects version 8.12.3-p4+tuxcare of laravel/framework, and is fixed in 8.12.3-p6+tuxcare." } }, { "id": "GHSA-4mg9-vhxq-vm7j", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } ], "bom-ref": "urn:uuid:4f66a7f4-5824-539b-bfc1-634b070c550a", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 8.12.3-p4+tuxcare of laravel/framework." } }, { "id": "GHSA-5vg9-5847-vvmq", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } ], "bom-ref": "urn:uuid:1c66e602-9030-56e2-bfbb-ed6a2008ce99", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 8.12.3-p4+tuxcare of laravel/framework." } }, { "id": "GHSA-6jvx-8ch9-j2jr", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } ], "bom-ref": "urn:uuid:d5984b6c-eb3c-57db-b637-fa67280210b0", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 8.12.3-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel 8.12.3 is not affected by GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie unserialization). The vulnerability affected Laravel 5.6.30 (August 2018) and was fixed by disabling PHP object serialization in cookie encryption. Laravel 8.12.3 (December 2020) shipped with this protection already in place: EncryptCookies uses `static $serialize = false` to prevent object unseria...", "justification": "code_not_present" } }, { "id": "GHSA-7852-w36x-6mf6", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } ], "bom-ref": "urn:uuid:93770f2f-20c2-5d33-9542-be263ad1e71f", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-7852-w36x-6mf6 does not affect version 8.12.3-p4+tuxcare of laravel/framework. not_affected \u2014 The target Laravel framework v8.12.3 is not affected by GHSA-7852-w36x-6mf6 (Laravel Encrypter IV length validation bypass). The vulnerability pattern is absent because the upstream fix was already present in Laravel v8.12.3 when TuxCare onboarded it. The validPayload() method includes IV length validation that prevents manipulated payloads from causing false-return decryption failures exploita...", "justification": "code_not_present" } }, { "id": "GHSA-crmm-hgp2-wgrp", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } ], "bom-ref": "urn:uuid:17f8fc7c-7ff3-5a69-9e93-3b254f0c6daa", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 8.12.3-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 8.12.3 does not implement local filesystem temporary signed URLs. The vulnerability targets LocalFilesystemAdapter::temporaryUrl() which was introduced in Laravel 10+. In Laravel 8.x, calling temporaryUrl() on local filesystem throws RuntimeException, preventing the attack chain from completing.", "justification": "code_not_present" } }, { "id": "GHSA-jwvj-pwww-3mj5", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } ], "bom-ref": "urn:uuid:1dd22d0b-374c-5fab-b3d1-7e2039acca1d", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-jwvj-pwww-3mj5 is fixed in version 8.12.3-p4+tuxcare of laravel/framework." } }, { "id": "GHSA-qm5c-m76r-2hfr", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } ], "bom-ref": "urn:uuid:1025ba6c-1168-514f-b52a-b17395c8379e", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-qm5c-m76r-2hfr affects version 8.12.3-p4+tuxcare of laravel/framework." } }, { "id": "GHSA-wq8p-mqvg-2p5h", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } ], "bom-ref": "urn:uuid:256425d1-8c11-5837-bde2-de55b73d20a5", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-wq8p-mqvg-2p5h is fixed in version 8.12.3-p4+tuxcare of laravel/framework." } }, { "id": "GHSA-x7p5-p2c9-phvg", "affects": [ { "ref": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } ], "bom-ref": "urn:uuid:caa156e0-49d2-59d5-823e-69428e5f223a", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 8.12.3-p4+tuxcare of laravel/framework." } } ], "dependencies": [ { "ref": "pkg:composer/laravel/framework@8.12.3-p4+tuxcare" } ] }