{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:0baddff2-99d9-5d34-868d-df75eb1f92b2",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-cas",
      "purl": "pkg:maven/org.springframework.security/spring-security-cas@5.6.7-tuxcare.6",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-cas@5.6.7-tuxcare.6",
      "version": "5.6.7-tuxcare.6",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-cas",
            "purl": "pkg:maven/org.springframework.security/spring-security-cas@5.6.7",
            "type": "library",
            "group": "org.springframework.security",
            "version": "5.6.7"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2019-11272",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-cas@5.6.7-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:0bbdaf62-1f10-5223-b224-7431855fab53",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-11272 does not affect version 5.6.7-tuxcare.6 of org.springframework.security:spring-security-cas. Spring Security 5.6.7 is not affected by CVE-2019-11272. The vulnerable class PlaintextPasswordEncoder was removed from Spring Security in version 5.0.0 (October 2017) by upstream maintainer Rob Winch, well before version 5.6.7 was released. The CVE affects versions 4.2.x up to 4.2.12 and older unsupported versions that still contained the deprecated authentication.encoding package. Version 5.6.7 uses the newer crypto.password package with NoOpPasswordEncoder, which does not exhibit the vulnerable null-to-string concatenation behavior.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-cas@5.6.7-tuxcare.6"
    }
  ]
}