{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:13fb092a-9745-59f1-8d88-6767231f734f", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.4", "type": "library", "group": "org.springframework", "name": "spring-orm", "version": "4.3.30.RELEASE-tuxcare.4", "purl": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.4" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:165d09bb-3504-5bc7-885d-11e0cfb7e0b5", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:f77e76c5-3582-50cb-892e-bbfb2fbf3fbf", "id": "CVE-2020-5397", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5397 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:6938f469-40eb-5831-a907-6ecaef178ff9", "id": "CVE-2020-5421", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5421 does not affect version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-orm. Version 4.3.30.RELEASE is not affected by CVE-2020-5421: the security fix is already present in the target branch. Momus prerequisite check: \"Patches already applied: 6327c60912cd80120040c8c16c3731d8bf6c19f6\". No backport needed." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:3f1379ed-be9a-5d2d-8367-8ad65b5bc763", "id": "CVE-2021-22060", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22060 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:8ce7b964-d769-5b71-8aef-262a02caabfa", "id": "CVE-2021-22096", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22096 does not affect version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-orm. CVE-2021-22096 fix already exists in commit 4895b739b3e5fea63ecb01ac867c136add560cf6" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:f0133351-84cb-56b4-831d-c2bd07638abd", "id": "CVE-2021-22118", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22118 does not affect version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-orm. Version 4.3.30.RELEASE is not vulnerable. Summary: Target repository is Spring Framework 4.3.30.RELEASE-tuxcare.2, which predates the introduction of WebFlux. The vulnerable code (reactive multipart handling with predictable temp directories) does not exist in this version. CVE-2021-22118 specifically affects WebFlux applications in Spring Framework 5.2.x prior to 5.2.15 and 5.3.x prior to 5.3.7. WebFlux was introduced in Spring Framework 5.0, and the vulnerable multipart han [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:f5fb9009-cb8a-5d8f-a097-d65aeb31773e", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:ac9af78f-a5fc-5a37-9dd3-b40ec14502b5", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:c5bff678-9cc5-51d9-a640-f111d391240c", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:24811074-b647-58c8-87d6-4e39f24d459b", "id": "CVE-2022-22970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:8a5db2ff-e2f9-5d6f-842c-baecc6d46bfa", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:1a8b9474-42b9-5eb3-b9a1-d446abe7dae3", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:db10ac57-1154-562c-892c-720ebc035cb1", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:04ce1af7-d92c-5ce3-878c-55bfd47af16c", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:132f10b6-7792-5d89-9c76-c634531a4c37", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:35279ebd-fbd1-5814-a5e2-bc2fa56ecadd", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:701b17fb-7cec-5f28-97be-9ae91f1f5e52", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:b32e0b4f-8481-5a29-901d-59541803c2ea", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:4a304df2-85b0-55a3-a037-206fb9af5128", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:ca1f06ab-47f4-5794-ae3d-27a7ccdcd5a8", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:ac0e5b3a-8a0e-5d93-9cc0-3d7a2deaf096", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:41d8a0b9-3c47-5a39-8dd2-090218bce9de", "id": "CVE-2025-41242", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41242 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:bf686423-986a-5cf7-8f15-43ccca9e8381", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:a8e3e8d6-3a45-5866-abd2-636172e967fc", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:ddd4cddf-d41b-58ed-81c6-9780299302d9", "id": "CVE-2026-22740", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-orm. CVE-2026-22740 is a WebFlux-specific vulnerability (reactive multipart temp-file cleanup in org.springframework.http.codec.multipart.MultipartHttpMessageReader / PartGenerator). Spring Framework 4.3.30.RELEASE predates WebFlux entirely - the org.springframework.http.codec package does not exist in this version, and there is no reactive multipart code path. Per NVD, affected versions are 5.3.x, 6.1.x, 6.2.x, 7.0.x only; Spring 4.x is not in the affected range." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d91a750e-8e2b-5a5b-bbbc-298d2c1e5fdd", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:58a6356a-f613-5d07-ab02-2d11fcc3b43f", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d9bdc69e-44f2-518b-86cf-46c3a9f2d7ba", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:49104442-fe58-5d64-b527-7d7147498030", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:a52a53ac-ccbc-51e5-90d0-7fe4318f0a34", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:72063dac-d6d8-53a4-9555-0b1136793882", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:2f497198-9f77-5e7b-8ffd-9f54ef677f91", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:48ece48d-1f50-5312-b075-a80fdfbf07a1", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:e3195b57-5970-5dbc-b8ea-a67d8eabb517", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:bb1b1326-4af4-53f0-a09f-bab483219146", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:3014f94e-db77-508d-a5f5-d6ab53b72c93", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:f2a017c1-19f6-538b-aefb-6bb5f1134f6c", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:6730d136-7baa-5bf0-81f4-b58c9ebcb349", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:9d3d2ca6-1c26-5235-9730-da2973ca2c00", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:98ae6462-07f9-59d2-b195-ca96adcc3743", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-orm. not_affected \u2014 Spring Framework 4.3.30 is not affected by CVE-2026-41853. This version predates Spring WebFlux (introduced in 5.0) and lacks the vulnerable component DefaultServerWebExchange.java. The vulnerability mechanism - Spring Framework's message reader selection based on wildcard Content-Type headers - does not exist in this servlet-based Spring MVC architecture." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:e15aa2ed-213a-588a-b076-de0ed6430339", "id": "CVE-2026-41854", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:4fbb9406-a1f5-5d8a-843a-cc1cd7d93568", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-orm." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.4" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-orm@4.3.30.RELEASE-tuxcare.4" } ] }