{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:169dd15d-494a-535e-b45f-c08d13db9f0c",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-cas",
      "purl": "pkg:maven/org.springframework.security/spring-security-cas@5.1.5.RELEASE-tuxcare.2",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-cas@5.1.5.RELEASE-tuxcare.2",
      "version": "5.1.5.RELEASE-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-cas",
            "purl": "pkg:maven/org.springframework.security/spring-security-cas@5.1.5.RELEASE",
            "type": "library",
            "group": "org.springframework.security",
            "version": "5.1.5.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2019-11272",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-cas@5.1.5.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:f3f981d5-d4cd-535d-8516-d0ba8d5d6dce",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-11272 does not affect version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-cas. CVE-2019-11272 affects PlaintextPasswordEncoder in Spring Security 4.2.x and older. The vulnerable class does not exist in Spring Security 5.1.5.RELEASE. It was removed in Spring Security 5.0.0 (Nov 2017) and replaced with NoOpPasswordEncoder. The replacement class uses Java's String.equals() method which correctly returns false when encodedPassword is null, preventing authentication bypass. The input (null encoded password) is received but the Brief's Goal (authentication success) is never reached due to equals() null handling. Tests from 2015 explicitly verify this safe behavior.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE).",
        "justification": "code_not_reachable"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-cas@5.1.5.RELEASE-tuxcare.2"
    }
  ]
}