{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:00c71bc7-e252-5528-b244-7c780cc08d74",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-cas",
      "purl": "pkg:maven/org.springframework.security/spring-security-cas@6.3.9-tuxcare.3",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-cas@6.3.9-tuxcare.3",
      "version": "6.3.9-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-cas",
            "purl": "pkg:maven/org.springframework.security/spring-security-cas@6.3.9",
            "type": "library",
            "group": "org.springframework.security",
            "version": "6.3.9"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2019-11272",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.3.9-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:c23fbb18-4177-5d57-a71f-451f47569eb4",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-11272 does not affect version 6.3.9-tuxcare.3 of org.springframework.security:spring-security-cas. Spring Security version 6.3.9 is not affected by CVE-2019-11272. The vulnerable PlaintextPasswordEncoder class was removed from Spring Security before version 5.0.0 (commit 12dbf2e961 on Oct 23, 2017 by upstream author Rob Winch). Version 6.3.9 does not contain this class at all, and the replacement NoOpPasswordEncoder does not exhibit the same vulnerability pattern. The removal was part of the upstream release that TuxCare onboarded, not a TuxCare-specific fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.3.9-tuxcare.3"
    }
  ]
}