{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:76a4c450-8ebf-5335-a1b3-cfa7eec406d9", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "framework", "purl": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare", "type": "library", "group": "laravel", "bom-ref": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare", "version": "5.7.29-p4+tuxcare", "pedigree": { "ancestors": [ { "name": "framework", "purl": "pkg:composer/laravel/framework@5.7.29", "type": "library", "group": "laravel", "version": "5.7.29" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2019-9081", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } ], "bom-ref": "urn:uuid:b50b85dc-7fea-59e1-84e9-724ece33a9f1", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2019-9081 is a false positive for laravel/framework 5.7.29-p4+tuxcare. CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19)." } }, { "id": "CVE-2020-19316", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } ], "bom-ref": "urn:uuid:336571c6-0210-51bf-ba07-752cfecec880", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-19316 is fixed in version 5.7.29-p4+tuxcare of laravel/framework." } }, { "id": "CVE-2020-24941", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } ], "bom-ref": "urn:uuid:a5955894-da03-55e0-8f36-f32acd9aae4c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-24941 is fixed in version 5.7.29-p4+tuxcare of laravel/framework." } }, { "id": "CVE-2021-21263", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } ], "bom-ref": "urn:uuid:267c1a0a-7afb-5b31-8529-1a51ac340a88", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-21263 is fixed in version 5.7.29-p4+tuxcare of laravel/framework." } }, { "id": "CVE-2021-43503", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } ], "bom-ref": "urn:uuid:c9b1a3b1-a2cc-5849-b07a-a6f0cab5435e", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2021-43503 is a false positive for laravel/framework 5.7.29-p4+tuxcare. CVE-2021-43503 revoked; GHSA withdrawn as not a security issue. Verified 2026-10-19: no tuxcare release changes the cited gadget files (PendingResourceRegistration, Capsule Manager), and no fix is needed." } }, { "id": "CVE-2021-43617", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } ], "bom-ref": "urn:uuid:e2bae163-f2f3-5669-89ba-79474b25190f", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.7.29-p4+tuxcare. GitHub advisory GHSA-364w-9g92-3grq is withdrawn \u2014 https://github.com/advisories/GHSA-364w-9g92-3grq" } }, { "id": "CVE-2021-43808", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } ], "bom-ref": "urn:uuid:e4d4d750-ff8b-554d-8c76-866bacba8d27", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-43808 is fixed in version 5.7.29-p4+tuxcare of laravel/framework." } }, { "id": "CVE-2022-31279", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } ], "bom-ref": "urn:uuid:b5ea63a2-80e4-577c-9f14-f5a52b0f5fb5", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2022-31279 is a false positive for laravel/framework 5.7.29-p4+tuxcare. CVE-2022-31279 was REJECTED/withdrawn by its CNA per NVD: \"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.\"" } }, { "id": "CVE-2024-52301", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } ], "bom-ref": "urn:uuid:f4c2474e-5c8b-56a5-a8f1-f7397ac6c399", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52301 is fixed in version 5.7.29-p4+tuxcare of laravel/framework." } }, { "id": "CVE-2025-27515", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } ], "bom-ref": "urn:uuid:fd768ecc-57a3-5988-ac64-a2cc6aeb72c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27515 is fixed in version 5.7.29-p4+tuxcare of laravel/framework." } }, { "id": "CVE-2026-102279", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } ], "bom-ref": "urn:uuid:f1cefe72-090b-51b1-b0a9-63f78567ed47", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-102279 does not affect version 5.7.29-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel Framework version 5.7.29 is not affected by CVE-2026-102279. This version uses the Whoops library for debug exception rendering, not Laravel's custom exception renderer with Tippy.js tooltips. The vulnerable code path (Tippy.js initialization with `allowHTML: true` for `data-tippy-content` elements) does not exist in version 5.7.29. The custom Laravel exception renderer was introduced i...", "justification": "code_not_present" } }, { "id": "CVE-2026-114509", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } ], "bom-ref": "urn:uuid:ba51cba1-27c3-5e45-86c4-2da337ea24a3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114509 affects version 5.7.29-p4+tuxcare of laravel/framework." } }, { "id": "GHSA-4mg9-vhxq-vm7j", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } ], "bom-ref": "urn:uuid:eb5f880c-8921-5388-8519-f5438bc3f406", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.7.29-p4+tuxcare of laravel/framework." } }, { "id": "GHSA-5vg9-5847-vvmq", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } ], "bom-ref": "urn:uuid:377aa0ad-94ee-5d60-a267-48927d122fee", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-5vg9-5847-vvmq does not affect version 5.7.29-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.7.29 uses SwiftMailer, not Symfony Mailer. The GHSA-5vg9-5847-vvmq vulnerability specifically requires Symfony Mailer's handling of CRLF sequences. SwiftMailer employs EmailValidator which rejects CRLF in email addresses, breaking the attack chain.", "justification": "protected_at_runtime" } }, { "id": "GHSA-crmm-hgp2-wgrp", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } ], "bom-ref": "urn:uuid:7e7989ef-f25c-579b-8afb-00a5922d914c", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.7.29-p4+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.7.29 does not support temporary signed URLs for local filesystem storage. The vulnerable feature (LocalFilesystemAdapter with temporaryUrl/temporaryUploadUrl methods) does not exist in this version. The FilesystemAdapter::temporaryUrl() method explicitly throws RuntimeException when used with LocalAdapter.", "justification": "code_not_present" } }, { "id": "GHSA-qm5c-m76r-2hfr", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } ], "bom-ref": "urn:uuid:0df775c2-d41f-58dc-ba31-024d787c9ae3", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.7.29-p4+tuxcare of laravel/framework." } }, { "id": "GHSA-x7p5-p2c9-phvg", "affects": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } ], "bom-ref": "urn:uuid:60c54fd5-4b4e-52b6-939a-8124b5785614", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.7.29-p4+tuxcare of laravel/framework." } } ], "dependencies": [ { "ref": "pkg:composer/laravel/framework@5.7.29-p4+tuxcare" } ] }