{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:0a4d7189-4a5c-5cf1-8bc9-1adbbdb87f67",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-oauth2-client",
      "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.6.5-tuxcare.4",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.6.5-tuxcare.4",
      "version": "5.6.5-tuxcare.4",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-oauth2-client",
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.6.5",
            "type": "library",
            "group": "org.springframework.security",
            "version": "5.6.5"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2021-22119",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.6.5-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:0f85239c-0c8e-5278-bc04-2e48034f962a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-22119 does not affect version 5.6.5-tuxcare.4 of org.springframework.security:spring-security-oauth2-client. The target Spring Security 5.6.5 is NOT AFFECTED by CVE-2021-22119. The vulnerability's denial-of-service pattern (unlimited accumulation of OAuth2 authorization requests in session storage) is not present in the target code. The fix was authored upstream by Craig Andrews (commit 35f5ebdbcf) and shipped with the Spring Security 5.6.5 release before TuxCare onboarded this version. The target code contains the complete mitigation: by default, only ONE authorization request is stored per session (overwriting previous requests), preventing resource exhaustion attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-31690",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.6.5-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:68b607ca-00c2-5221-9198-f5e7d037aea3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-31690 affects version 5.6.5-tuxcare.4 of org.springframework.security:spring-security-oauth2-client."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.6.5-tuxcare.4"
    }
  ]
}