{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3243f43e-46cb-548d-a6c5-f763b7a2d67d", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework.boot/spring-boot-starter-artemis@2.3.6.RELEASE-tuxcare.6", "type": "library", "group": "org.springframework.boot", "name": "spring-boot-starter-artemis", "version": "2.3.6.RELEASE-tuxcare.6", "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-artemis@2.3.6.RELEASE-tuxcare.6" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:9c8fa436-848b-5554-ac71-656f583806a9", "id": "CVE-2022-22965", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 2.3.6.RELEASE-tuxcare.6 of org.springframework.boot:spring-boot-starter-artemis. CVE-2022-22965 (Spring4Shell) is a data-binding RCE whose vulnerable code resides entirely in Spring Framework's spring-beans module (CachedIntrospectionResults). Spring Boot ships no vulnerable code for this CVE \u2014 it only dependency-manages the Spring Framework version via its BOM." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-artemis@2.3.6.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:6bcb64e3-61b1-58c7-8313-8739c5b8a89e", "id": "CVE-2023-20873", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20873 is fixed in version 2.3.6.RELEASE-tuxcare.6 of org.springframework.boot:spring-boot-starter-artemis." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-artemis@2.3.6.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:a2a29437-cfd1-5d6c-92f0-0dc09e863d31", "id": "CVE-2023-20883", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20883 is fixed in version 2.3.6.RELEASE-tuxcare.6 of org.springframework.boot:spring-boot-starter-artemis." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-artemis@2.3.6.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:fd67161c-df0a-5acd-8c92-abcef91508bd", "id": "CVE-2023-34055", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-34055 is fixed in version 2.3.6.RELEASE-tuxcare.6 of org.springframework.boot:spring-boot-starter-artemis." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-artemis@2.3.6.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:0c19abd1-66f3-5c7d-8422-8110db60aeb9", "id": "CVE-2023-38286", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2023-38286 is a false positive for org.springframework.boot:spring-boot-starter-artemis 2.3.6.RELEASE-tuxcare.6." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-artemis@2.3.6.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:1ffa36c8-1b0e-5199-8c97-2541b2164309", "id": "CVE-2024-38807", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38807 is fixed in version 2.3.6.RELEASE-tuxcare.6 of org.springframework.boot:spring-boot-starter-artemis." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-artemis@2.3.6.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:25b3567a-6ea0-5826-aff5-eefbe67e0fd4", "id": "CVE-2025-22235", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22235 is fixed in version 2.3.6.RELEASE-tuxcare.6 of org.springframework.boot:spring-boot-starter-artemis." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-artemis@2.3.6.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:808ef584-1f30-56e6-a066-6ed0a35331b5", "id": "CVE-2026-22733", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22733 is fixed in version 2.3.6.RELEASE-tuxcare.6 of org.springframework.boot:spring-boot-starter-artemis." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-artemis@2.3.6.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:203106c0-1318-55d0-bba7-9ecfc092825d", "id": "CVE-2026-40972", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40972 is fixed in version 2.3.6.RELEASE-tuxcare.6 of org.springframework.boot:spring-boot-starter-artemis." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-artemis@2.3.6.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:eea983a4-d65b-56bc-9acb-d8f571c83875", "id": "CVE-2026-40973", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40973 is fixed in version 2.3.6.RELEASE-tuxcare.6 of org.springframework.boot:spring-boot-starter-artemis." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-artemis@2.3.6.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:91098aef-59e8-59d6-907b-7f026fee0b99", "id": "CVE-2026-40974", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40974 is fixed in version 2.3.6.RELEASE-tuxcare.6 of org.springframework.boot:spring-boot-starter-artemis." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-artemis@2.3.6.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ac3b1c42-b05c-5f2d-837a-1b32db203f1d", "id": "CVE-2026-40975", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40975 is fixed in version 2.3.6.RELEASE-tuxcare.6 of org.springframework.boot:spring-boot-starter-artemis." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-artemis@2.3.6.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:328f06fa-9e8e-5ca8-9b07-f63616180fb3", "id": "CVE-2026-40977", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40977 is fixed in version 2.3.6.RELEASE-tuxcare.6 of org.springframework.boot:spring-boot-starter-artemis." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-artemis@2.3.6.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:acd19de4-d936-5906-8466-262f63a1a874", "id": "CVE-2026-40992", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-40992 does not affect version 2.3.6.RELEASE-tuxcare.6 of org.springframework.boot:spring-boot-starter-artemis. not_affected \u2014 Spring Boot 2.3.6.RELEASE-tuxcare.4 is not affected by CVE-2026-40992. The vulnerability affects the MailProperties.Ssl auto-configuration feature introduced in Spring Boot 3.4+, which does not exist in version 2.3.6. The target version uses a simpler architecture where mail auto-configuration only passes through user-configured JavaMail properties without actively managing SSL configuration." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-artemis@2.3.6.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c9ce37f3-8ce6-5037-b451-7d6dd5fff784", "id": "CVE-2026-41001", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41001 is fixed in version 2.3.6.RELEASE-tuxcare.6 of org.springframework.boot:spring-boot-starter-artemis." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-artemis@2.3.6.RELEASE-tuxcare.6" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-artemis@2.3.6.RELEASE-tuxcare.6" } ] }