{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7cdc87d2-d7e8-5f02-9b29-0ebafa05daa8", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "framework", "purl": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare", "type": "library", "group": "laravel", "bom-ref": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare", "version": "5.7.29-p3+tuxcare", "pedigree": { "ancestors": [ { "name": "framework", "purl": "pkg:composer/laravel/framework@5.7.29", "type": "library", "group": "laravel", "version": "5.7.29" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2019-9081", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } ], "bom-ref": "urn:uuid:c06ed860-77a0-55cd-a89d-a3d9d7a05e98", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2019-9081 is a false positive for laravel/framework 5.7.29-p3+tuxcare. CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19)." } }, { "id": "CVE-2020-19316", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } ], "bom-ref": "urn:uuid:e942a2c8-61f4-5a90-b5ab-a3ed91b09f33", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-19316 is fixed in version 5.7.29-p3+tuxcare of laravel/framework." } }, { "id": "CVE-2020-24941", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } ], "bom-ref": "urn:uuid:0d668dae-c13d-5f95-9c5a-2267f5534e0d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-24941 is fixed in version 5.7.29-p3+tuxcare of laravel/framework." } }, { "id": "CVE-2021-21263", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } ], "bom-ref": "urn:uuid:8d546caa-ef6a-570f-9263-8f3c4477a2b6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-21263 is fixed in version 5.7.29-p3+tuxcare of laravel/framework." } }, { "id": "CVE-2021-43503", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } ], "bom-ref": "urn:uuid:150af7db-1f40-56dc-907b-b3769aa914db", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2021-43503 is a false positive for laravel/framework 5.7.29-p3+tuxcare. CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed." } }, { "id": "CVE-2021-43617", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } ], "bom-ref": "urn:uuid:44db7476-ab02-58cc-bde5-e31012722c92", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.7.29-p3+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" } }, { "id": "CVE-2021-43808", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } ], "bom-ref": "urn:uuid:458b0c76-6f01-536a-b4fd-3b73a4363f6a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-43808 is fixed in version 5.7.29-p3+tuxcare of laravel/framework." } }, { "id": "CVE-2022-31279", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } ], "bom-ref": "urn:uuid:0290732b-2ab0-5e2d-a086-340237e10044", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 5.7.29-p3+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" } }, { "id": "CVE-2024-52301", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } ], "bom-ref": "urn:uuid:c80153ea-14d4-5c5c-992c-206bb20ba445", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52301 is fixed in version 5.7.29-p3+tuxcare of laravel/framework." } }, { "id": "CVE-2025-27515", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } ], "bom-ref": "urn:uuid:6c6ccc5d-6ddc-5014-8c28-3a4c1a27e718", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27515 is fixed in version 5.7.29-p3+tuxcare of laravel/framework." } }, { "id": "CVE-2026-102279", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } ], "bom-ref": "urn:uuid:53ee04c1-68ef-5b5c-87ec-e5ff0e3734a6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-102279 does not affect version 5.7.29-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework version 5.7.29 is not affected by CVE-2026-102279. This version uses the Whoops library for debug exception rendering, not Laravel's custom exception renderer with Tippy.js tooltips. The vulnerable code path (Tippy.js initialization with `allowHTML: true` for `data-tippy-content` elements) does not exist in version 5.7.29. The custom Laravel exception renderer was introduced i...", "justification": "code_not_present" } }, { "id": "CVE-2026-114509", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } ], "bom-ref": "urn:uuid:539ee3e9-93cd-5427-9954-ac3f27dbf3cd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114509 affects version 5.7.29-p3+tuxcare of laravel/framework." } }, { "id": "GHSA-4mg9-vhxq-vm7j", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } ], "bom-ref": "urn:uuid:1c0f0ac8-1f06-53cc-9598-8ec4430c006f", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.7.29-p3+tuxcare of laravel/framework." } }, { "id": "GHSA-5vg9-5847-vvmq", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } ], "bom-ref": "urn:uuid:333bdcdb-c640-5c6f-adbd-88f423d16565", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-5vg9-5847-vvmq does not affect version 5.7.29-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.7.29 uses SwiftMailer, not Symfony Mailer. The GHSA-5vg9-5847-vvmq vulnerability specifically requires Symfony Mailer's handling of CRLF sequences. SwiftMailer employs EmailValidator which rejects CRLF in email addresses, breaking the attack chain.", "justification": "protected_at_runtime" } }, { "id": "GHSA-crmm-hgp2-wgrp", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } ], "bom-ref": "urn:uuid:864ce8a5-f728-51c9-932e-454afc778e20", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.7.29-p3+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.7.29 does not support temporary signed URLs for local filesystem storage. The vulnerable feature (LocalFilesystemAdapter with temporaryUrl/temporaryUploadUrl methods) does not exist in this version. The FilesystemAdapter::temporaryUrl() method explicitly throws RuntimeException when used with LocalAdapter.", "justification": "code_not_present" } }, { "id": "GHSA-qm5c-m76r-2hfr", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } ], "bom-ref": "urn:uuid:a14dbd42-4a32-5f1a-b52d-5ed2564c8b33", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.7.29-p3+tuxcare of laravel/framework." } }, { "id": "GHSA-x7p5-p2c9-phvg", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } ], "bom-ref": "urn:uuid:e41028ba-09fa-5f8a-8779-32bb12cce802", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.7.29-p3+tuxcare of laravel/framework." } } ], "dependencies": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p3+tuxcare" } ] }