{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:9012c119-498b-583c-82a6-3d257a7754ad",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-oauth2-client",
      "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.1.6-tuxcare.8",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.1.6-tuxcare.8",
      "version": "6.1.6-tuxcare.8",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-oauth2-client",
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.1.6",
            "type": "library",
            "group": "org.springframework.security",
            "version": "6.1.6"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2021-22119",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.1.6-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:11d5ab2b-21fd-5967-8138-df57ed1bacca",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-22119 does not affect version 6.1.6-tuxcare.8 of org.springframework.security:spring-security-oauth2-client. The target Spring Security 6.1.6 is not affected by CVE-2021-22119. The upstream vendor fix (commit 35f5ebdbcf) that prevents DoS via unbounded OAuth2 authorization request accumulation was included in the 6.1.6 release. Both servlet (HttpSessionOAuth2AuthorizationRequestRepository) and WebFlux (WebSessionOAuth2ServerAuthorizationRequestRepository) implementations now store only ONE authorization request per session instead of accumulating multiple requests in a Map. The vulnerable pattern (Map-based unbounded accumulation) is not present in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-31690",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.1.6-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:3ccaab23-8c32-5de8-b335-90d285e89ad8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-31690 does not affect version 6.1.6-tuxcare.8 of org.springframework.security:spring-security-oauth2-client. The target repository (Spring Security 6.1.6-tuxcare.9) is not affected by CVE-2022-31690. The vulnerability involved improper OAuth2 scope handling where token response clients would automatically fill empty scope lists with originally requested scopes, enabling privilege escalation when a malicious Authorization Server returned empty scopes. All fixes for this vulnerability were already present in the upstream Spring Security 6.1.6 release that TuxCare onboarded. The vulnerable scope-defaulting logic has been removed from all affected token response client classes (Default* and WebClientReactive* variants), and the OidcUserService properly handles empty scopes. Both fix commits (75004587a419a96d18909030b20c6b16b226ecbe and fde26e003a648a670be40c690a028970f0d1137b) were authored by upstream Spring Security developers and are ancestors of the first TuxCare commit in this branch's history.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), cve.org (>= 5.7, <= 5.7.4; >= 5.6, <= 5.6.8), Snyk (< 5.4.11; >= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.1.6-tuxcare.8"
    }
  ]
}