{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:96ab8a0d-849e-505d-817a-bd2832c8642f",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-bom",
      "purl": "pkg:maven/org.springframework.security/spring-security-bom@5.6.7-tuxcare.4",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-bom@5.6.7-tuxcare.4",
      "version": "5.6.7-tuxcare.4",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-bom",
            "purl": "pkg:maven/org.springframework.security/spring-security-bom@5.6.7",
            "type": "library",
            "group": "org.springframework.security",
            "version": "5.6.7"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2021-22112",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-bom@5.6.7-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:ee921048-5e00-586c-b6cf-8c1169e92d7b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-22112 does not affect version 5.6.7-tuxcare.4 of org.springframework.security:spring-security-bom. CVE-2021-22112 is not present in this target. The vulnerability (failure to save SecurityContext when changed multiple times in a single request) was fixed by upstream Spring Security commit 3116369f027f26e74839b840330c01ce94498bec, authored by Rob Winch, which shipped in Spring Security 5.6.7. The target is based on that upstream 5.6.7 release (onboarded via commit a7dda868db by TuxCare), so the fix was already present before any TuxCare modifications. The fix adds an isSaveContextInvoked boolean flag that tracks saveContext() invocations and includes it in the contextChanged() check, ensuring subsequent saves persist to the HTTP session even when called multiple times per request.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-bom@5.6.7-tuxcare.4"
    }
  ]
}