{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:0a3b828c-9110-539d-9e8f-76a9c2ae5344",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-cas",
      "purl": "pkg:maven/org.springframework.security/spring-security-cas@5.6.3-tuxcare.2",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-cas@5.6.3-tuxcare.2",
      "version": "5.6.3-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-cas",
            "purl": "pkg:maven/org.springframework.security/spring-security-cas@5.6.3",
            "type": "library",
            "group": "org.springframework.security",
            "version": "5.6.3"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2019-11272",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-cas@5.6.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:95a4442d-7a5b-5da2-9a55-074f3354d638",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-11272 does not affect version 5.6.3-tuxcare.2 of org.springframework.security:spring-security-cas. The target Spring Security 5.6.3 is not affected by CVE-2019-11272. The vulnerable class PlaintextPasswordEncoder was removed from Spring Security in October 2017 (commit 12dbf2e961) before the 5.0.0 release. This removal is an ancestor of the target version. The CVE explicitly states it affects \"versions 4.2.x up to 4.2.12, and older unsupported versions\" \u2014 version 5.6.3 is outside this range. PlaintextPasswordEncoder was replaced by NoOpPasswordEncoder in the crypto module, which does not have the null password vulnerability because it uses standard .equals() comparison instead of the vulnerable string concatenation pattern.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-cas@5.6.3-tuxcare.2"
    }
  ]
}