{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:88778637-d929-56a5-bda5-17a98a4d50aa",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-oauth2-client",
      "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.6.3-tuxcare.2",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.6.3-tuxcare.2",
      "version": "5.6.3-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-oauth2-client",
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.6.3",
            "type": "library",
            "group": "org.springframework.security",
            "version": "5.6.3"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2021-22119",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.6.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:8b2664e6-008a-543e-9cdf-e5a2d77b96e4",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-22119 does not affect version 5.6.3-tuxcare.2 of org.springframework.security:spring-security-oauth2-client. The target Spring Security 5.6.3-tuxcare.2 is NOT AFFECTED by CVE-2021-22119. The vulnerability (DoS via unbounded OAuth2 authorization request accumulation in HTTP sessions) has been fixed by upstream commit 35f5ebdbcf. This fix was already present in the upstream Spring Security 5.6.3 release that TuxCare onboarded. The target code limits authorization request storage to one request per session by default (with a deprecated opt-in for multiple requests), preventing the resource exhaustion attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-31690",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.6.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:b6a5979d-90f7-57da-a10c-cd8199c871df",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-31690 affects version 5.6.3-tuxcare.2 of org.springframework.security:spring-security-oauth2-client."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.6.3-tuxcare.2"
    }
  ]
}