{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:23eb06a6-ff68-5a21-8e07-af9afc2f8487", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework.boot/spring-boot-jarmode-layertools@2.3.6.RELEASE-tuxcare.5", "type": "library", "group": "org.springframework.boot", "name": "spring-boot-jarmode-layertools", "version": "2.3.6.RELEASE-tuxcare.5", "purl": "pkg:maven/org.springframework.boot/spring-boot-jarmode-layertools@2.3.6.RELEASE-tuxcare.5" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:f34b99e2-97b7-5265-85c5-5fbab0423afb", "id": "CVE-2022-22965", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:spring-boot-jarmode-layertools. CVE-2022-22965 (Spring4Shell) is a data-binding RCE whose vulnerable code resides entirely in Spring Framework's spring-beans module (CachedIntrospectionResults). Spring Boot ships no vulnerable code for this CVE \u2014 it only dependency-manages the Spring Framework version via its BOM." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-jarmode-layertools@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:234266ef-0622-55e9-97c2-aec3248cc361", "id": "CVE-2023-20873", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20873 is fixed in version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:spring-boot-jarmode-layertools." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-jarmode-layertools@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:9a06a480-cf12-5fb2-9d12-2b1d027aaafb", "id": "CVE-2023-20883", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20883 is fixed in version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:spring-boot-jarmode-layertools." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-jarmode-layertools@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:de101043-7c20-50b5-b0d8-021a7cd68eaf", "id": "CVE-2023-34055", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-34055 is fixed in version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:spring-boot-jarmode-layertools." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-jarmode-layertools@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:372385df-9c2f-5ce8-a247-c3b564364cb5", "id": "CVE-2023-38286", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2023-38286 is a false positive for org.springframework.boot:spring-boot-jarmode-layertools 2.3.6.RELEASE-tuxcare.5." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-jarmode-layertools@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:3bab6b58-33a7-58e4-b282-a4b08a975bfb", "id": "CVE-2024-38807", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38807 is fixed in version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:spring-boot-jarmode-layertools." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-jarmode-layertools@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:9f4f0932-ae79-5406-8914-b6a367d3d4d3", "id": "CVE-2025-22235", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22235 is fixed in version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:spring-boot-jarmode-layertools." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-jarmode-layertools@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:e4999cef-3047-57af-b547-6fe488a0554a", "id": "CVE-2026-22733", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22733 is fixed in version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:spring-boot-jarmode-layertools." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-jarmode-layertools@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:ce0db4f1-a69a-5329-9293-54fd13622392", "id": "CVE-2026-40972", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40972 is fixed in version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:spring-boot-jarmode-layertools." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-jarmode-layertools@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:fa2009ab-6bfb-563c-8863-5b47e0533e4b", "id": "CVE-2026-40973", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40973 is fixed in version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:spring-boot-jarmode-layertools." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-jarmode-layertools@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:8be59eb1-6b39-5b32-ab0a-074311c24ee5", "id": "CVE-2026-40974", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40974 is fixed in version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:spring-boot-jarmode-layertools." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-jarmode-layertools@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:647d2125-8fb2-5f28-b03b-293b874a5ee6", "id": "CVE-2026-40975", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40975 is fixed in version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:spring-boot-jarmode-layertools." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-jarmode-layertools@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d344b994-454f-51d8-b198-8c6e63dbbaee", "id": "CVE-2026-40977", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40977 is fixed in version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:spring-boot-jarmode-layertools." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-jarmode-layertools@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:ef0f2d52-8422-5bb9-a2fc-913f11f4f2cc", "id": "CVE-2026-40992", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-40992 does not affect version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:spring-boot-jarmode-layertools. not_affected \u2014 Spring Boot 2.3.6.RELEASE-tuxcare.4 is not affected by CVE-2026-40992. The vulnerability affects the MailProperties.Ssl auto-configuration feature introduced in Spring Boot 3.4+, which does not exist in version 2.3.6. The target version uses a simpler architecture where mail auto-configuration only passes through user-configured JavaMail properties without actively managing SSL configuration." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-jarmode-layertools@2.3.6.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:b3d02c3b-1b10-57ed-a259-1ecfbd19872b", "id": "CVE-2026-41001", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41001 is fixed in version 2.3.6.RELEASE-tuxcare.5 of org.springframework.boot:spring-boot-jarmode-layertools." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-jarmode-layertools@2.3.6.RELEASE-tuxcare.5" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-jarmode-layertools@2.3.6.RELEASE-tuxcare.5" } ] }