{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:f043c99f-93f6-56bd-ae2e-65ece5e9a394",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-bom",
      "purl": "pkg:maven/org.springframework.security/spring-security-bom@5.7.11-tuxcare.14",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-bom@5.7.11-tuxcare.14",
      "version": "5.7.11-tuxcare.14",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-bom",
            "purl": "pkg:maven/org.springframework.security/spring-security-bom@5.7.11",
            "type": "library",
            "group": "org.springframework.security",
            "version": "5.7.11"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2007-1651",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-bom@5.7.11-tuxcare.14"
        }
      ],
      "bom-ref": "urn:uuid:f5b09c96-6b3e-58b4-8ffd-c81d10256d69",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2007-1651 is a false positive for org.springframework.security:spring-security-bom 5.7.11-tuxcare.14. direct vulnerability is in OpenID project"
      }
    },
    {
      "id": "CVE-2007-1652",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-bom@5.7.11-tuxcare.14"
        }
      ],
      "bom-ref": "urn:uuid:19c3ed28-425b-5160-96b4-8d6d2b25cd3a",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2007-1652 is a false positive for org.springframework.security:spring-security-bom 5.7.11-tuxcare.14. direct vulnerability is in OpenID project"
      }
    },
    {
      "id": "CVE-2021-22112",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-bom@5.7.11-tuxcare.14"
        }
      ],
      "bom-ref": "urn:uuid:3554afab-f84f-5780-8dd2-7b07eb40f9ad",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-22112 does not affect version 5.7.11-tuxcare.14 of org.springframework.security:spring-security-bom. CVE-2021-22112 is NOT present in Spring Security 5.7.11. The vulnerability involved HttpSessionSecurityContextRepository failing to save the SecurityContext when it was changed multiple times in a single request. The upstream fix (commit c72a6fac04) introduced a `isSaveContextInvoked` flag to track whether saveContext() has been called, ensuring subsequent context changes are properly detected and saved. This fix was already included in the upstream Spring Security 5.7.11 release before TuxCare onboarded the project, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-bom@5.7.11-tuxcare.14"
    }
  ]
}