{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:93ac6c79-8610-5bdf-bd85-a4e7d86a682e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-saml2-service-provider", "purl": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@5.6.10-tuxcare.15", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@5.6.10-tuxcare.15", "version": "5.6.10-tuxcare.15", "pedigree": { "ancestors": [ { "name": "spring-security-saml2-service-provider", "purl": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@5.6.10", "type": "library", "group": "org.springframework.security", "version": "5.6.10" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2007-1651", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@5.6.10-tuxcare.15" } ], "bom-ref": "urn:uuid:96db0ab4-7b8b-5875-a700-b0c18aa01880", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2007-1651 is a false positive for org.springframework.security:spring-security-saml2-service-provider 5.6.10-tuxcare.15. False positive \u2014 OpenID CVE, not related to Spring Security. CVE-2007-1651 affects OpenID Provider application handling of cached \u201calways trust\u201d authorization. Spring Security is a relying-party consumer; its DISCOVERY_INFO_KEY cleanup only prevents reuse of local callback/discovery state and does not address the provider-side forced-login flaw. No upstream evidence identifies Spring Security as an affected product." } }, { "id": "CVE-2007-1652", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@5.6.10-tuxcare.15" } ], "bom-ref": "urn:uuid:38dd69a0-80ed-52dd-95ae-d0273cfee579", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2007-1652 is a false positive for org.springframework.security:spring-security-saml2-service-provider 5.6.10-tuxcare.15. CVE-2007-1652 is a vulnerability in JanRain's myOpenID hosted service, on the OpenID Provider side. NVD records it with vendor and product \\\"n/a\\\" behind a single unversioned CPE, cpe:2.3:a:openid:openid:*, and every reference points to JanRain's March 2007 myOpenID security-fix announcement and to the openid.net security mailing list of the same month, where the reporter states the problem had to be fixed on the myOpenID server. The reported mechanism - using cached tokens and an existing Provider session to forcibly log a user into a site, disclose their personal information to it, and add that site permanently to the user's trusted-sites list - is Provider-side behaviour; a trusted-sites auto-approval list exists only at the Provider and has no counterpart in a relying party. The corresponding GitHub advisory, GHSA-3x88-xvgr-m6fg, is unreviewed and lists no affected package in any ecosystem.The openid module of Spring Security implements only the relying-party (consumer) role. OpenIDConsumer and its single implementation OpenID4JavaConsumer wrap openid4java's ConsumerManager to begin and end a consumption, and OpenIDAuthenticationFilter together with OpenIDAuthenticationProvider turn the result into an Authentication. The only openid4java packages referenced anywhere in the source tree are consumer, discovery, message and association; there is no use of org.openid4java.server, no ServerManager, no OpenID Provider implementation, and no trusted-sites or \\\"always trust\\\" handling of any kind, nor are any openid4java sources vendored into the tree. Nor could the library have been affected when the issue was disclosed: the advisory was published in March 2007, while the earliest OpenID code in this project was contributed in April 2007 and the openid4java-based consumer only appeared in July 2007. The vulnerability therefore does not apply to Spring Security in any version, including 5.6.10." } }, { "id": "CVE-2026-40988", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@5.6.10-tuxcare.15" } ], "bom-ref": "urn:uuid:fc20fdbb-35f4-5ca7-9d5f-84bbe0d1cb7d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40988 is fixed in version 5.6.10-tuxcare.15 of org.springframework.security:spring-security-saml2-service-provider." } }, { "id": "CVE-2026-40993", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@5.6.10-tuxcare.15" } ], "bom-ref": "urn:uuid:6cad220e-9d2d-5f52-b35d-a9e75a247e6f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-40993 does not affect version 5.6.10-tuxcare.15 of org.springframework.security:spring-security-saml2-service-provider. Spring Security 5.6.10 is not affected by CVE-2026-40993. The vulnerable component JdbcAssertingPartyMetadataRepository does not exist in this version. The CVE affects versions 7.0.0-7.0.5, which introduced database persistence for SAML2 asserting party metadata using Java serialization. Version 5.6.10 only provides InMemoryRelyingPartyRegistrationRepository with no database persistence or credential deserialization capabilities. The entire architectural feature (JDBC-backed SAML2 metadata repository) was introduced in the 7.x series and is absent from the 5.x codebase.", "justification": "code_not_present" } }, { "id": "CVE-2026-41003", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@5.6.10-tuxcare.15" } ], "bom-ref": "urn:uuid:24b7e0e6-f550-534b-998e-fa5cb724cb6f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41003 is fixed in version 5.6.10-tuxcare.15 of org.springframework.security:spring-security-saml2-service-provider." } }, { "id": "CVE-2026-41694", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@5.6.10-tuxcare.15" } ], "bom-ref": "urn:uuid:c4cf72ec-3115-5cc3-84e4-a364aab45df1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41694 is fixed in version 5.6.10-tuxcare.15 of org.springframework.security:spring-security-saml2-service-provider." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@5.6.10-tuxcare.15" } ] }