{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:46ea8ff3-1410-5e47-8065-ad77c9063789", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare", "type": "library", "group": "laravel", "name": "framework", "version": "5.6.40-p2+tuxcare", "purl": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:17859acf-14bc-5433-81a4-0d8500fa4933", "id": "CVE-2020-19316", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-19316 is fixed in version 5.6.40-p2+tuxcare of laravel/framework." }, "affects": [ { "ref": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } ] }, { "bom-ref": "urn:uuid:7e17e7ab-72e6-52d5-b98c-003d9c126510", "id": "CVE-2020-24941", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-24941 is fixed in version 5.6.40-p2+tuxcare of laravel/framework." }, "affects": [ { "ref": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } ] }, { "bom-ref": "urn:uuid:ffc13e42-b320-59e3-b93e-7fb3843ff6bc", "id": "CVE-2021-21263", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-21263 is fixed in version 5.6.40-p2+tuxcare of laravel/framework." }, "affects": [ { "ref": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } ] }, { "bom-ref": "urn:uuid:29386de4-32f6-5354-8de4-da5b4ba8d600", "id": "CVE-2021-43503", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-43503 is fixed in version 5.6.40-p2+tuxcare of laravel/framework." }, "affects": [ { "ref": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } ] }, { "bom-ref": "urn:uuid:8e083a45-0a84-5250-8a6f-013ce6f00d3b", "id": "CVE-2021-43617", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.6.40-p2+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" }, "affects": [ { "ref": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } ] }, { "bom-ref": "urn:uuid:8bb35409-9760-52c3-ae9c-ab6288d4e93e", "id": "CVE-2021-43808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-43808 is fixed in version 5.6.40-p2+tuxcare of laravel/framework." }, "affects": [ { "ref": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } ] }, { "bom-ref": "urn:uuid:3c915f10-4614-50d7-9fdc-024022f54af4", "id": "CVE-2022-31279", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 5.6.40-p2+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" }, "affects": [ { "ref": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } ] }, { "bom-ref": "urn:uuid:f20c5e58-82f4-5eef-b0c8-b47a9a2a8ae4", "id": "CVE-2024-52301", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52301 is fixed in version 5.6.40-p2+tuxcare of laravel/framework." }, "affects": [ { "ref": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } ] }, { "bom-ref": "urn:uuid:9b24a2a7-f56a-585f-ab96-5f67ed04b1af", "id": "CVE-2025-27515", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27515 is fixed in version 5.6.40-p2+tuxcare of laravel/framework." }, "affects": [ { "ref": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } ] }, { "bom-ref": "urn:uuid:668651c0-42bd-519b-b8d0-f93b08b31ae6", "id": "GHSA-4mg9-vhxq-vm7j", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.6.40-p2+tuxcare of laravel/framework." }, "affects": [ { "ref": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } ] }, { "bom-ref": "urn:uuid:ed2385f2-687b-5a35-a107-36d74b4fa99a", "id": "GHSA-5vg9-5847-vvmq", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-5vg9-5847-vvmq does not affect version 5.6.40-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.6.40-p1+tuxcare uses SwiftMailer 6.3.0, not the Symfony Mailer targeted by GHSA-5vg9-5847-vvmq. SwiftMailer's Egulias EmailValidator provides CRLF validation that prevents the vulnerability pattern from manifesting." }, "affects": [ { "ref": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } ] }, { "bom-ref": "urn:uuid:c904b2c7-a424-58e2-9af0-b6055e669195", "id": "GHSA-crmm-hgp2-wgrp", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.6.40-p2+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.6.40 does not have the vulnerable LocalFilesystemAdapter class or signed URL generation for local filesystem. The feature was introduced in Laravel 11+ (September 2024), years after this version. The FilesystemAdapter.temporaryUrl() method explicitly throws RuntimeException for local adapters - the feature is unsupported." }, "affects": [ { "ref": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } ] }, { "bom-ref": "urn:uuid:ce58f39b-8a2c-54c8-8971-6b7dcac2615f", "id": "GHSA-qm5c-m76r-2hfr", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.6.40-p2+tuxcare of laravel/framework." }, "affects": [ { "ref": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } ] }, { "bom-ref": "urn:uuid:e3518c16-75ff-5fb2-a458-88276c9a2634", "id": "GHSA-x7p5-p2c9-phvg", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.6.40-p2+tuxcare of laravel/framework." }, "affects": [ { "ref": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } ] } ], "dependencies": [ { "ref": "pkg:composer/laravel/framework@5.6.40-p2+tuxcare" } ] }