{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:7ac1dae9-0ff0-5aa6-abd4-4ce44537604e",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-cas",
      "purl": "pkg:maven/org.springframework.security/spring-security-cas@6.5.11-tuxcare.6",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-cas@6.5.11-tuxcare.6",
      "version": "6.5.11-tuxcare.6",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-cas",
            "purl": "pkg:maven/org.springframework.security/spring-security-cas@6.5.11",
            "type": "library",
            "group": "org.springframework.security",
            "version": "6.5.11"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2019-11272",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.5.11-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:a7a82fe1-0fb7-526c-8445-2e3f39922f4e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-11272 does not affect version 6.5.11-tuxcare.6 of org.springframework.security:spring-security-cas. Spring Security 6.5.11 is not affected by CVE-2019-11272. The vulnerable PlaintextPasswordEncoder class was completely removed from Spring Security in October 2017 (commit 12dbf2e961) as part of an upstream architectural refactoring for version 5.0+. This removal happened years before version 6.5.11 was created and before TuxCare's onboarding. The CVE affects versions 4.2.x and earlier that still contained the authentication.encoding.PlaintextPasswordEncoder class. Version 6.5.11 uses the modern crypto.password package with a completely different architecture that does not have the vulnerable pattern.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.5.11-tuxcare.6"
    }
  ]
}