{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:60e23137-00b1-5863-8346-35d5f7d8e26e",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-bom",
      "purl": "pkg:maven/org.springframework.security/spring-security-bom@5.6.9-tuxcare.5",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-bom@5.6.9-tuxcare.5",
      "version": "5.6.9-tuxcare.5",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-bom",
            "purl": "pkg:maven/org.springframework.security/spring-security-bom@5.6.9",
            "type": "library",
            "group": "org.springframework.security",
            "version": "5.6.9"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2021-22112",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-bom@5.6.9-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:b56811f7-624c-5273-a68d-cdfd283f6cc2",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-22112 does not affect version 5.6.9-tuxcare.5 of org.springframework.security:spring-security-bom. CVE-2021-22112 affects Spring Security versions prior to 5.4.4, 5.3.8.RELEASE, and 5.2.9.RELEASE. The vulnerability allows SecurityContext changes made multiple times in a single request to fail to save the final state, potentially extending elevated privileges beyond their intended scope. The target version 5.6.9 already contains the upstream fix (commit c72a6fac04) which was integrated into Spring Security 5.4.4 and later releases in January 2021. The fix adds a boolean flag `isSaveContextInvoked` to track multiple saveContext invocations and ensures the final SecurityContext is persisted correctly. This is an upstream fix that shipped in the 5.6.9 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-bom@5.6.9-tuxcare.5"
    }
  ]
}