{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:a5bfc6fe-275c-5cfc-87cd-7a63785ecc33",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-oauth2-client",
      "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.7.12-tuxcare.14",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.7.12-tuxcare.14",
      "version": "5.7.12-tuxcare.14",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-oauth2-client",
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.7.12",
            "type": "library",
            "group": "org.springframework.security",
            "version": "5.7.12"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2007-1651",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.7.12-tuxcare.14"
        }
      ],
      "bom-ref": "urn:uuid:2bf8be08-d7aa-553f-9910-092e1c2f80c4",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2007-1651 is a false positive for org.springframework.security:spring-security-oauth2-client 5.7.12-tuxcare.14. False positive \u2014 OpenID CVE, not related to Spring Security. CVE-2007-1651 affects OpenID Provider application handling of cached \u201calways trust\u201d authorization. Spring Security is a relying-party consumer; its DISCOVERY_INFO_KEY cleanup only prevents reuse of local callback/discovery state and does not address the provider-side forced-login flaw. No upstream evidence identifies Spring Security as an affected product."
      }
    },
    {
      "id": "CVE-2007-1652",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.7.12-tuxcare.14"
        }
      ],
      "bom-ref": "urn:uuid:3b6dfdaa-7359-5f0d-894b-eada3239ef0b",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2007-1652 is a false positive for org.springframework.security:spring-security-oauth2-client 5.7.12-tuxcare.14. direct vulnerability is in OpenID project"
      }
    },
    {
      "id": "CVE-2021-22119",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.7.12-tuxcare.14"
        }
      ],
      "bom-ref": "urn:uuid:a11e002f-ed03-5481-a114-c20f2edab22d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-22119 does not affect version 5.7.12-tuxcare.14 of org.springframework.security:spring-security-oauth2-client. CVE-2021-22119: Spring Security 5.7.12-tuxcare.12 is NOT AFFECTED. The DoS vulnerability via unbounded OAuth2 authorization request accumulation was fixed in upstream Spring Security 5.5.1. The target version (5.7.12) already contains the fix shipped by the upstream vendor (commit 35f5ebdbcf by Craig Andrews). The defense mechanism limits each session to one pending authorization request by default, preventing memory exhaustion attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-31690",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.7.12-tuxcare.14"
        }
      ],
      "bom-ref": "urn:uuid:7e0d1759-bcc6-5bc5-bad2-36d4926072a4",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-31690 does not affect version 5.7.12-tuxcare.14 of org.springframework.security:spring-security-oauth2-client. The target Spring Security 5.7.12 is not affected by CVE-2022-31690. The vulnerability involved OAuth2 clients incorrectly defaulting empty scope responses from Authorization Servers to the originally requested scopes, leading to privilege escalation. Both required fixes (commits 75004587a4 and fde26e003a) were authored by upstream Spring Security maintainer Steve Riesenberg and were already present in the upstream Spring Security 5.7.12 release before TuxCare onboarded it. The vulnerable pattern (defaulting empty scopes to requested scopes in initial token acquisition flows) is not present in any of the affected classes: DefaultAuthorizationCodeTokenResponseClient, DefaultPasswordTokenResponseClient, DefaultClientCredentialsTokenResponseClient, and OidcUserService all correctly preserve empty scope lists or handle them appropriately per OAuth2 specifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), cve.org (>= 5.7, <= 5.7.4; >= 5.6, <= 5.6.8), Snyk (< 5.4.11; >= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.7.12-tuxcare.14"
    }
  ]
}