{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:abc7b459-3517-5a29-86f8-95457e2d1dc7",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-cas",
      "purl": "pkg:maven/org.springframework.security/spring-security-cas@5.1.4.RELEASE-tuxcare.2",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-cas@5.1.4.RELEASE-tuxcare.2",
      "version": "5.1.4.RELEASE-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-cas",
            "purl": "pkg:maven/org.springframework.security/spring-security-cas@5.1.4.RELEASE",
            "type": "library",
            "group": "org.springframework.security",
            "version": "5.1.4.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2019-11272",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-cas@5.1.4.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a3b8bc70-4ba0-5fd9-bbe4-5f9f2ed9b89b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-11272 does not affect version 5.1.4.RELEASE-tuxcare.2 of org.springframework.security:spring-security-cas. Spring Security 5.1.4.RELEASE is not affected by CVE-2019-11272. The vulnerable class PlaintextPasswordEncoder was completely removed from the codebase in the upstream Spring Security 5.0 release (October 23, 2017), approximately 1.5 years before version 5.1.4.RELEASE was published (February 13, 2019). The CVE explicitly states it affects \"versions 4.2.x up to 4.2.12, and older unsupported versions\" \u2014 the target version 5.1.4.RELEASE is newer and does not contain the affected code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-cas@5.1.4.RELEASE-tuxcare.2"
    }
  ]
}