{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:964ef5c2-f6c2-5293-a6ab-7029348cad7e",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-oauth2-client",
      "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.2",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.2",
      "version": "6.0.7-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-oauth2-client",
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7",
            "type": "library",
            "group": "org.springframework.security",
            "version": "6.0.7"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2021-22119",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:5e3d3e56-854d-51bf-b43c-af048b0ebd2c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-22119 does not affect version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-client. Spring Security 6.0.7-tuxcare.2 is NOT AFFECTED by CVE-2021-22119. The vulnerable pattern (unbounded Map storage of OAuth2 authorization requests leading to DoS via memory exhaustion) is not present in the target. The upstream fix commit 35f5ebdbcf was already included in the 6.0.7 release when TuxCare onboarded it. The code stores only ONE authorization request per session, with each new request overwriting the previous one, preventing unbounded memory growth.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-31690",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:10e24721-c57b-5bc6-81c3-d7c3f53d4ee3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-31690 does not affect version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-client. CVE-2022-31690: The target Spring Security 6.0.7-tuxcare.2 is NOT AFFECTED. The vulnerable pattern (automatically filling empty OAuth2 scope lists with client registration scopes, leading to privilege escalation) was fixed in upstream commits 75004587a4 (\"Fix scope mapping\") and fde26e003a (\"Request user info when AS returns no scopes\"), both authored by Steve Riesenberg (sriesenberg@vmware.com) and already included in the upstream Spring Security 6.0.7 release before TuxCare onboarded it. The target code correctly preserves empty scope lists returned by Authorization Servers instead of defaulting to all requested scopes, preventing the privilege escalation vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), cve.org (>= 5.7, <= 5.7.4; >= 5.6, <= 5.6.8), Snyk (< 5.4.11; >= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.2"
    }
  ]
}