{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:9fa989cd-6ce1-5506-bb07-362900136f03", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "aggs-matrix-stats-client", "purl": "pkg:maven/org.elasticsearch.plugin/aggs-matrix-stats-client@7.17.15-tuxcare.1", "type": "library", "group": "org.elasticsearch.plugin", "bom-ref": "pkg:maven/org.elasticsearch.plugin/aggs-matrix-stats-client@7.17.15-tuxcare.1", "version": "7.17.15-tuxcare.1", "pedigree": { "ancestors": [ { "name": "aggs-matrix-stats-client", "purl": "pkg:maven/org.elasticsearch.plugin/aggs-matrix-stats-client@7.17.15", "type": "library", "group": "org.elasticsearch.plugin", "version": "7.17.15" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2023-49921", "affects": [ { "ref": "pkg:maven/org.elasticsearch.plugin/aggs-matrix-stats-client@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:2ec7c968-70e4-52c2-9bf1-464042419fff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-49921 affects version 7.17.15-tuxcare.1 of org.elasticsearch.plugin:aggs-matrix-stats-client." } }, { "id": "CVE-2024-23444", "affects": [ { "ref": "pkg:maven/org.elasticsearch.plugin/aggs-matrix-stats-client@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:d6e587bc-a160-567f-b84f-b1ce25b98519", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-23444 is fixed in version 7.17.15-tuxcare.1 of org.elasticsearch.plugin:aggs-matrix-stats-client." } }, { "id": "CVE-2024-23446", "affects": [ { "ref": "pkg:maven/org.elasticsearch.plugin/aggs-matrix-stats-client@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:ac44a36d-d2a2-5512-942b-3b78ed2d07a8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23446 affects version 7.17.15-tuxcare.1 of org.elasticsearch.plugin:aggs-matrix-stats-client." } }, { "id": "CVE-2024-23450", "affects": [ { "ref": "pkg:maven/org.elasticsearch.plugin/aggs-matrix-stats-client@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:4ea42122-30e4-5aab-bba9-9d51ec6e83fc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-23450 affects version 7.17.15-tuxcare.1 of org.elasticsearch.plugin:aggs-matrix-stats-client." } }, { "id": "CVE-2024-43709", "affects": [ { "ref": "pkg:maven/org.elasticsearch.plugin/aggs-matrix-stats-client@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:15e769a7-1989-5b09-a45d-8da9bc118d89", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-43709 is fixed in version 7.17.15-tuxcare.1 of org.elasticsearch.plugin:aggs-matrix-stats-client." } }, { "id": "CVE-2024-52979", "affects": [ { "ref": "pkg:maven/org.elasticsearch.plugin/aggs-matrix-stats-client@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:961bc8e6-bb36-58cf-b70f-0ae39feb16d5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52979 is fixed in version 7.17.15-tuxcare.1 of org.elasticsearch.plugin:aggs-matrix-stats-client." } }, { "id": "CVE-2024-52980", "affects": [ { "ref": "pkg:maven/org.elasticsearch.plugin/aggs-matrix-stats-client@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:13906ad6-eb59-5e57-a85d-1271e22bf95c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-52980 affects version 7.17.15-tuxcare.1 of org.elasticsearch.plugin:aggs-matrix-stats-client." } }, { "id": "CVE-2024-52981", "affects": [ { "ref": "pkg:maven/org.elasticsearch.plugin/aggs-matrix-stats-client@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:cb22d2d8-6022-53db-b7cc-d4d7ae44b2ae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-52981 affects version 7.17.15-tuxcare.1 of org.elasticsearch.plugin:aggs-matrix-stats-client." } }, { "id": "CVE-2025-37727", "affects": [ { "ref": "pkg:maven/org.elasticsearch.plugin/aggs-matrix-stats-client@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:aa8fed03-3f26-5433-85e9-3a9206a5d99f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-37727 affects version 7.17.15-tuxcare.1 of org.elasticsearch.plugin:aggs-matrix-stats-client." } }, { "id": "CVE-2025-37731", "affects": [ { "ref": "pkg:maven/org.elasticsearch.plugin/aggs-matrix-stats-client@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:9c0a5b79-99d0-5123-9dbe-999c60f1e396", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-37731 affects version 7.17.15-tuxcare.1 of org.elasticsearch.plugin:aggs-matrix-stats-client." } }, { "id": "CVE-2025-68384", "affects": [ { "ref": "pkg:maven/org.elasticsearch.plugin/aggs-matrix-stats-client@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:278d39b6-e9c8-5c50-8dfa-55f8bfe6b36a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-68384 does not affect version 7.17.15-tuxcare.1 of org.elasticsearch.plugin:aggs-matrix-stats-client. not_affected \u2014 Elasticsearch 7.17.15 does not contain the User Profile feature (ProfileService) that is affected by CVE-2025-68384. The vendor patches add size validation to ProfileService.updateProfileData(), which stores user profile labels and applicationData. This entire feature was introduced in Elasticsearch 8.2+ and is completely absent from the 7.x series. Exhaustive searches confirm no ProfileService...", "justification": "code_not_present" } }, { "id": "CVE-2025-68390", "affects": [ { "ref": "pkg:maven/org.elasticsearch.plugin/aggs-matrix-stats-client@7.17.15-tuxcare.1" } ], "bom-ref": "urn:uuid:ffb9dbf7-3009-58d6-9f71-dc19119e11f6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-68390 affects version 7.17.15-tuxcare.1 of org.elasticsearch.plugin:aggs-matrix-stats-client." } } ], "dependencies": [ { "ref": "pkg:maven/org.elasticsearch.plugin/aggs-matrix-stats-client@7.17.15-tuxcare.1" } ] }