{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:89abd964-f20f-5f8c-bc25-1edfc1cd50e8",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-oauth2-client",
      "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.5.8-tuxcare.1",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.5.8-tuxcare.1",
      "version": "5.5.8-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-oauth2-client",
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.5.8",
            "type": "library",
            "group": "org.springframework.security",
            "version": "5.5.8"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2021-22119",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.5.8-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8e5f6f7c-435f-590d-9388-2f2f57478153",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-22119 does not affect version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-oauth2-client. CVE-2021-22119 affects Spring Security 5.5.x prior to 5.5.1. The target is version 5.5.8-tuxcare.2, which contains the upstream fix from commit 35f5ebdbcf. The fix changes HttpSessionOAuth2AuthorizationRequestRepository to store only one authorization request per session by default (preventing DoS through unbounded Map accumulation). The fix was shipped in upstream Spring Security 5.5.0/5.5.1 and was already present when TuxCare onboarded version 5.5.8. The vulnerable pattern (unconditional Map storage allowing unlimited authorization requests per session) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-31690",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.5.8-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d08933fe-d990-53eb-a445-5db4a1355839",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-31690 affects version 5.5.8-tuxcare.1 of org.springframework.security:spring-security-oauth2-client."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.5.8-tuxcare.1"
    }
  ]
}