{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:b0215fdf-86fc-59d6-862a-274e4c4ba524",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-cas",
      "purl": "pkg:maven/org.springframework.security/spring-security-cas@6.2.2-tuxcare.10",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.2-tuxcare.10",
      "version": "6.2.2-tuxcare.10",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-cas",
            "purl": "pkg:maven/org.springframework.security/spring-security-cas@6.2.2",
            "type": "library",
            "group": "org.springframework.security",
            "version": "6.2.2"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2019-11272",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.2-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:39da7f10-bb22-5dff-9603-525956f7fe8c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-11272 does not affect version 6.2.2-tuxcare.10 of org.springframework.security:spring-security-cas. Spring Security 6.2.2 is not affected by CVE-2019-11272. The vulnerable class PlaintextPasswordEncoder was removed from Spring Security in version 5.0.0.RC1 (October 2017) via commit 12dbf2e961, years before version 6.2.2 was released. The removal was an upstream change by Rob Winch and was included in the upstream release that TuxCare onboarded. The modern replacement NoOpPasswordEncoder uses .equals() for password comparison, which correctly returns false when comparing against null, and does not exhibit the vulnerable null-to-string-\"null\" conversion behavior.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.2-tuxcare.10"
    }
  ]
}