{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2a70ca94-e190-5889-826e-615d5054f127", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework.boot/org.springframework.boot.gradle.plugin@2.3.6.RELEASE-tuxcare.5", "type": "library", "group": "org.springframework.boot", "name": "org.springframework.boot.gradle.plugin", "version": "2.3.6.RELEASE-tuxcare.5", "purl": "pkg:maven/org.springframework.boot/org.springframework.boot.gradle.plugin@2.3.6.RELEASE-tuxcare.5" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:5a4e9229-b989-5de8-97e6-6391235f0ec6", "id": "CVE-2022-22965", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:org.springframework.boot.gradle.plugin. CVE-2022-22965 (Spring4Shell) is a data-binding RCE whose vulnerable code resides entirely in Spring Framework's spring-beans module (CachedIntrospectionResults). Spring Boot ships no vulnerable code for this CVE \u2014 it only dependency-manages the Spring Framework version via its BOM." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/org.springframework.boot.gradle.plugin@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:127af135-8a39-574d-a979-ec0b84c4fc8d", "id": "CVE-2023-20873", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20873 is fixed in version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:org.springframework.boot.gradle.plugin." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/org.springframework.boot.gradle.plugin@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:8f12c031-5d89-5713-85e6-0dc3b66aff91", "id": "CVE-2023-20883", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20883 is fixed in version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:org.springframework.boot.gradle.plugin." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/org.springframework.boot.gradle.plugin@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:b5f2dbae-f4b1-56d7-a16b-2dfe51cf278b", "id": "CVE-2023-34055", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-34055 is fixed in version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:org.springframework.boot.gradle.plugin." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/org.springframework.boot.gradle.plugin@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:75b6fda5-371f-5827-bd49-6dca5c0cf345", "id": "CVE-2023-38286", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2023-38286 is a false positive for org.springframework.boot:org.springframework.boot.gradle.plugin 2.3.6.RELEASE-tuxcare.5." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/org.springframework.boot.gradle.plugin@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a7921fed-7e1d-527d-b1a9-64cd0a4ab1a5", "id": "CVE-2024-38807", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38807 is fixed in version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:org.springframework.boot.gradle.plugin." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/org.springframework.boot.gradle.plugin@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:46fa12f1-a7da-5c9a-aaee-ec2834485d65", "id": "CVE-2025-22235", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22235 is fixed in version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:org.springframework.boot.gradle.plugin." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/org.springframework.boot.gradle.plugin@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:48bd67dc-9ee7-527d-b48f-a2ffedde734b", "id": "CVE-2026-22733", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22733 is fixed in version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:org.springframework.boot.gradle.plugin." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/org.springframework.boot.gradle.plugin@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:0a0bfebb-f3cd-572a-bcec-01b768a10208", "id": "CVE-2026-40972", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40972 is fixed in version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:org.springframework.boot.gradle.plugin." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/org.springframework.boot.gradle.plugin@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:b373b944-fd17-586f-88f3-cd9143aa6311", "id": "CVE-2026-40973", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40973 is fixed in version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:org.springframework.boot.gradle.plugin." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/org.springframework.boot.gradle.plugin@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:1509ad04-2f59-5558-af3b-f095de4b1656", "id": "CVE-2026-40974", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40974 is fixed in version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:org.springframework.boot.gradle.plugin." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/org.springframework.boot.gradle.plugin@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:b6c302cc-9e8e-5ce7-a435-1da7a4a4c72c", "id": "CVE-2026-40975", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40975 is fixed in version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:org.springframework.boot.gradle.plugin." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/org.springframework.boot.gradle.plugin@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:3731a47c-1800-506f-87ca-7eed54a044fa", "id": "CVE-2026-40977", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40977 is fixed in version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:org.springframework.boot.gradle.plugin." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/org.springframework.boot.gradle.plugin@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:cd6c1e14-a203-5a2f-885a-46d7585a0f36", "id": "CVE-2026-40992", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-40992 does not affect version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:org.springframework.boot.gradle.plugin. not_affected \u2014 Spring Boot 2.3.6.RELEASE-tuxcare.4 is not affected by CVE-2026-40992. The vulnerability affects the MailProperties.Ssl auto-configuration feature introduced in Spring Boot 3.4+, which does not exist in version 2.3.6. The target version uses a simpler architecture where mail auto-configuration only passes through user-configured JavaMail properties without actively managing SSL configuration." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/org.springframework.boot.gradle.plugin@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:39372d8f-7c2e-563d-9d62-beaf1532d9e9", "id": "CVE-2026-41001", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41001 is fixed in version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:org.springframework.boot.gradle.plugin." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/org.springframework.boot.gradle.plugin@2.3.6.RELEASE-tuxcare.5" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.boot/org.springframework.boot.gradle.plugin@2.3.6.RELEASE-tuxcare.5" } ] }