{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:26870ee1-14d5-50e0-8bd9-56d85d6c6e5c", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare", "type": "library", "group": "laravel", "name": "framework", "version": "5.5.50-p2+tuxcare", "purl": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:fff9d28d-1c73-54c6-8a22-9c138e81a7ee", "id": "CVE-2018-15133", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-15133 does not affect version 5.5.50-p2+tuxcare of laravel/framework. Version 5.5.50 is not vulnerable. Summary: The target Laravel Framework v5.5.50-p2+tuxcare is NOT vulnerable to CVE-2018-15133. While the X-XSRF-TOKEN decryption feature exists, the vulnerable code pattern does not. The fix has been properly applied: the decrypt() method is called with false as the second parameter (via static::serialized()), preventing unsafe deserialization of the X-XSRF-TOKEN header value." }, "affects": [ { "ref": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } ] }, { "bom-ref": "urn:uuid:d1148468-ee69-59e9-b0cb-b7e8ad4b485b", "id": "CVE-2020-19316", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-19316 is fixed in version 5.5.50-p2+tuxcare of laravel/framework." }, "affects": [ { "ref": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } ] }, { "bom-ref": "urn:uuid:3662aed2-63ec-56dd-a110-a34bc570d3de", "id": "CVE-2020-24941", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-24941 is fixed in version 5.5.50-p2+tuxcare of laravel/framework." }, "affects": [ { "ref": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } ] }, { "bom-ref": "urn:uuid:90ec4b3d-481c-506b-a523-00bc8bacd45c", "id": "CVE-2021-21263", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-21263 is fixed in version 5.5.50-p2+tuxcare of laravel/framework." }, "affects": [ { "ref": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } ] }, { "bom-ref": "urn:uuid:4b4c84b6-91c6-554c-8d6b-461903abd29d", "id": "CVE-2021-43503", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-43503 is fixed in version 5.5.50-p2+tuxcare of laravel/framework." }, "affects": [ { "ref": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } ] }, { "bom-ref": "urn:uuid:49b8133d-69ee-5d1a-8338-314764ff6276", "id": "CVE-2021-43617", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-43617 is fixed in version 5.5.50-p2+tuxcare of laravel/framework." }, "affects": [ { "ref": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } ] }, { "bom-ref": "urn:uuid:0484638b-8609-548c-ba51-11f38a312727", "id": "CVE-2021-43808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-43808 is fixed in version 5.5.50-p2+tuxcare of laravel/framework." }, "affects": [ { "ref": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } ] }, { "bom-ref": "urn:uuid:acb59f51-5763-5dce-afb1-d4a1a81589d6", "id": "CVE-2022-31279", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 5.5.50-p2+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" }, "affects": [ { "ref": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } ] }, { "bom-ref": "urn:uuid:7d6cf680-38b8-5609-9e55-4b0bbae63c5c", "id": "CVE-2024-52301", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52301 is fixed in version 5.5.50-p2+tuxcare of laravel/framework." }, "affects": [ { "ref": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } ] }, { "bom-ref": "urn:uuid:41094eb5-f819-5246-81d3-3bb2701f0252", "id": "CVE-2025-27515", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27515 is fixed in version 5.5.50-p2+tuxcare of laravel/framework." }, "affects": [ { "ref": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } ] }, { "bom-ref": "urn:uuid:0cc38e74-2292-5c5b-8627-2bf0896f12a2", "id": "GHSA-4mg9-vhxq-vm7j", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.5.50-p2+tuxcare of laravel/framework." }, "affects": [ { "ref": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } ] }, { "bom-ref": "urn:uuid:46d14f34-ec0c-55cd-a074-3a3cc4ab20a7", "id": "GHSA-5vg9-5847-vvmq", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-5vg9-5847-vvmq does not affect version 5.5.50-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.5.50 uses SwiftMailer v6.3.0, not Symfony Mailer. The CVE explicitly describes a combination vulnerability requiring both Laravel's missing CRLF validation AND Symfony Mailer/Mime's specific handling of CRLF characters. Since the target uses a different mail library (SwiftMailer), the specific attack chain described in the CVE cannot be completed." }, "affects": [ { "ref": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } ] }, { "bom-ref": "urn:uuid:827367f1-aad1-5208-ab96-1112a868a901", "id": "GHSA-6jvx-8ch9-j2jr", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-6jvx-8ch9-j2jr does not affect version 5.5.50-p2+tuxcare of laravel/framework. Version 5.5.50 is not vulnerable. Summary: The target repository (Laravel 5.5.50-p2+tuxcare) is NOT VULNERABLE to GHSA-6jvx-8ch9-j2jr (PHP object injection via cookie serialization). The repository has been patched with a global serialization disable mechanism that is more secure than the vendor's original selective fix." }, "affects": [ { "ref": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } ] }, { "bom-ref": "urn:uuid:956ae932-27c9-513c-ad3c-9eb0ae5ba3e3", "id": "GHSA-crmm-hgp2-wgrp", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.5.50-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.5.50 is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects Laravel's LocalFilesystemAdapter class and its built-in local filesystem temporary URL generation feature, which was introduced in Laravel 11.x and does not exist in Laravel 5.x." }, "affects": [ { "ref": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } ] }, { "bom-ref": "urn:uuid:6331cc56-fe02-5326-b88e-ecdf2680bf37", "id": "GHSA-qm5c-m76r-2hfr", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.5.50-p2+tuxcare of laravel/framework." }, "affects": [ { "ref": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } ] }, { "bom-ref": "urn:uuid:6a16998d-81ec-500d-8424-5995fc35436e", "id": "GHSA-x7p5-p2c9-phvg", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.5.50-p2+tuxcare of laravel/framework." }, "affects": [ { "ref": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } ] } ], "dependencies": [ { "ref": "pkg:composer/laravel/framework@5.5.50-p2+tuxcare" } ] }