{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:5eb21880-7a6b-5ab8-9ac6-61fd1d1b1114", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-saml2-service-provider", "purl": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@5.6.10-tuxcare.13", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@5.6.10-tuxcare.13", "version": "5.6.10-tuxcare.13", "pedigree": { "ancestors": [ { "name": "spring-security-saml2-service-provider", "purl": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@5.6.10", "type": "library", "group": "org.springframework.security", "version": "5.6.10" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2007-1651", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@5.6.10-tuxcare.13" } ], "bom-ref": "urn:uuid:252131a6-1f3e-5149-8d63-cdd93bc7784c", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2007-1651 is a false positive for org.springframework.security:spring-security-saml2-service-provider 5.6.10-tuxcare.13. False positive \u2014 OpenID CVE, not related to Spring Security. CVE-2007-1651 affects OpenID Provider application handling of cached \u201calways trust\u201d authorization. Spring Security is a relying-party consumer; its DISCOVERY_INFO_KEY cleanup only prevents reuse of local callback/discovery state and does not address the provider-side forced-login flaw. No upstream evidence identifies Spring Security as an affected product." } }, { "id": "CVE-2007-1652", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@5.6.10-tuxcare.13" } ], "bom-ref": "urn:uuid:df4fd01d-e727-501a-9e05-f3f1d727049c", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2007-1652 is a false positive for org.springframework.security:spring-security-saml2-service-provider 5.6.10-tuxcare.13. CVE-2007-1652 is a vulnerability in JanRain's myOpenID hosted service, on the OpenID Provider side. NVD records it with vendor and product \\\"n/a\\\" behind a single unversioned CPE, cpe:2.3:a:openid:openid:*, and every reference points to JanRain's March 2007 myOpenID security-fix announcement and to the openid.net security mailing list of the same month, where the reporter states the problem had to be fixed on the myOpenID server. The reported mechanism - using cached tokens and an existing Provider session to forcibly log a user into a site, disclose their personal information to it, and add that site permanently to the user's trusted-sites list - is Provider-side behaviour; a trusted-sites auto-approval list exists only at the Provider and has no counterpart in a relying party. The corresponding GitHub advisory, GHSA-3x88-xvgr-m6fg, is unreviewed and lists no affected package in any ecosystem.The openid module of Spring Security implements only the relying-party (consumer) role. OpenIDConsumer and its single implementation OpenID4JavaConsumer wrap openid4java's ConsumerManager to begin and end a consumption, and OpenIDAuthenticationFilter together with OpenIDAuthenticationProvider turn the result into an Authentication. The only openid4java packages referenced anywhere in the source tree are consumer, discovery, message and association; there is no use of org.openid4java.server, no ServerManager, no OpenID Provider implementation, and no trusted-sites or \\\"always trust\\\" handling of any kind, nor are any openid4java sources vendored into the tree. Nor could the library have been affected when the issue was disclosed: the advisory was published in March 2007, while the earliest OpenID code in this project was contributed in April 2007 and the openid4java-based consumer only appeared in July 2007. The vulnerability therefore does not apply to Spring Security in any version, including 5.6.10." } }, { "id": "CVE-2026-40988", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@5.6.10-tuxcare.13" } ], "bom-ref": "urn:uuid:f5432e26-371d-5479-b747-a2fb744826a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40988 is fixed in version 5.6.10-tuxcare.13 of org.springframework.security:spring-security-saml2-service-provider." } }, { "id": "CVE-2026-40993", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@5.6.10-tuxcare.13" } ], "bom-ref": "urn:uuid:b9eac075-2559-5b4c-840d-fe9f5f62c07d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-40993 does not affect version 5.6.10-tuxcare.13 of org.springframework.security:spring-security-saml2-service-provider. Spring Security 5.6.10 is not affected by CVE-2026-40993. The vulnerable component JdbcAssertingPartyMetadataRepository does not exist in this version. The CVE affects versions 7.0.0-7.0.5, which introduced database persistence for SAML2 asserting party metadata using Java serialization. Version 5.6.10 only provides InMemoryRelyingPartyRegistrationRepository with no database persistence or credential deserialization capabilities. The entire architectural feature (JDBC-backed SAML2 metadata repository) was introduced in the 7.x series and is absent from the 5.x codebase.", "justification": "code_not_present" } }, { "id": "CVE-2026-41003", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@5.6.10-tuxcare.13" } ], "bom-ref": "urn:uuid:aae48bc6-dd69-5b89-ac71-594b9f3f783b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41003 is fixed in version 5.6.10-tuxcare.13 of org.springframework.security:spring-security-saml2-service-provider." } }, { "id": "CVE-2026-41694", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@5.6.10-tuxcare.13" } ], "bom-ref": "urn:uuid:7fe5a25d-b921-5c08-8934-a3597670edab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41694 is fixed in version 5.6.10-tuxcare.13 of org.springframework.security:spring-security-saml2-service-provider." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@5.6.10-tuxcare.13" } ] }