{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:1f998b6f-d4fb-5d85-b0e9-d13a74440d5f",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-bom",
      "purl": "pkg:maven/org.springframework.security/spring-security-bom@6.3.9-tuxcare.4",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-bom@6.3.9-tuxcare.4",
      "version": "6.3.9-tuxcare.4",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-bom",
            "purl": "pkg:maven/org.springframework.security/spring-security-bom@6.3.9",
            "type": "library",
            "group": "org.springframework.security",
            "version": "6.3.9"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2021-22112",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-bom@6.3.9-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:0927630d-c1e0-5505-b4ef-24fde593faec",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-22112 does not affect version 6.3.9-tuxcare.4 of org.springframework.security:spring-security-bom. CVE-2021-22112 does not affect Spring Security 6.3.9. The vulnerability, which allowed SecurityContext changes to not be saved when modified multiple times in a single request, was fixed in upstream Spring Security 5.4.4 (January 2021). The fix was already present in the upstream 6.3.9 release that TuxCare onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-bom@6.3.9-tuxcare.4"
    }
  ]
}