{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:fe856cbc-d2c4-5b19-8df0-91410b47e1c4",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-cas",
      "purl": "pkg:maven/org.springframework.security/spring-security-cas@5.7.11-tuxcare.10",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-cas@5.7.11-tuxcare.10",
      "version": "5.7.11-tuxcare.10",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-cas",
            "purl": "pkg:maven/org.springframework.security/spring-security-cas@5.7.11",
            "type": "library",
            "group": "org.springframework.security",
            "version": "5.7.11"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2007-1651",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-cas@5.7.11-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:8dbb2b72-89c1-556e-9ceb-5a71b6e7afbe",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2007-1651 is a false positive for org.springframework.security:spring-security-cas 5.7.11-tuxcare.10. direct vulnerability is in OpenID project"
      }
    },
    {
      "id": "CVE-2007-1652",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-cas@5.7.11-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:e153ab2f-dc44-54ef-9062-c2b53b1726ed",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2007-1652 is a false positive for org.springframework.security:spring-security-cas 5.7.11-tuxcare.10. direct vulnerability is in OpenID project"
      }
    },
    {
      "id": "CVE-2019-11272",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-cas@5.7.11-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:9ec3bf26-c946-5107-9955-baed68496411",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-11272 does not affect version 5.7.11-tuxcare.10 of org.springframework.security:spring-security-cas. CVE-2019-11272 affects PlaintextPasswordEncoder in Spring Security 4.2.x and older versions. The vulnerability allows authentication bypass when a user has a null encoded password by submitting the string \"null\" as the password. Target version 5.7.11-tuxcare.11 is NOT affected because PlaintextPasswordEncoder was removed entirely from Spring Security 5.0 by upstream (commit 12dbf2e961, October 2017), almost 2 years before the CVE was discovered (June 2019). The vulnerable class does not exist in any 5.x version. TuxCare backported the fix to older versions (3.2.8, 1.0.7, 4.2.12) that still had the code, but 5.x versions never required the fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-cas@5.7.11-tuxcare.10"
    }
  ]
}