{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:afea5403-efb1-51aa-9474-ad8eb3e18f54",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-cas",
      "purl": "pkg:maven/org.springframework.security/spring-security-cas@5.1.2.RELEASE-tuxcare.1",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-cas@5.1.2.RELEASE-tuxcare.1",
      "version": "5.1.2.RELEASE-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-cas",
            "purl": "pkg:maven/org.springframework.security/spring-security-cas@5.1.2.RELEASE",
            "type": "library",
            "group": "org.springframework.security",
            "version": "5.1.2.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2019-11272",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-cas@5.1.2.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d62be324-c7a4-508a-8b52-989afc41549d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-11272 does not affect version 5.1.2.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas. The target Spring Security 5.1.2.RELEASE is not affected by CVE-2019-11272. The vulnerable class PlaintextPasswordEncoder was removed from Spring Security in version 5.0 (October 2017, commit 12dbf2e961), nearly 2 years before the CVE was disclosed in June 2019. The removal was part of upstream Spring Security's architectural refactoring, where the deprecated authentication.encoding package was replaced by the crypto.password package with modern password encoders. The target version does not contain PlaintextPasswordEncoder anywhere in its codebase, and the replacement NoOpPasswordEncoder does not have the null-to-string conversion vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-cas@5.1.2.RELEASE-tuxcare.1"
    }
  ]
}