{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:e64e2746-ed6b-500f-b9e0-8a4c84837ff0",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-oauth2-client",
      "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.2-tuxcare.7",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.2-tuxcare.7",
      "version": "6.2.2-tuxcare.7",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-oauth2-client",
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.2",
            "type": "library",
            "group": "org.springframework.security",
            "version": "6.2.2"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2021-22119",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.2-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:ca2543e8-2042-5e5c-827f-d476923c6c18",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-22119 does not affect version 6.2.2-tuxcare.7 of org.springframework.security:spring-security-oauth2-client. CVE-2021-22119 describes a DoS vulnerability where attackers could exhaust system resources by sending multiple OAuth2 authorization requests that accumulate unboundedly in session storage. The target Spring Security 6.2.2 is NOT affected because the upstream fix was already present in the release that TuxCare onboarded. Both servlet (HttpSessionOAuth2AuthorizationRequestRepository) and WebFlux (WebSessionOAuth2ServerAuthorizationRequestRepository) implementations store only ONE authorization request per session, overwriting previous requests instead of accumulating them in a Map. The vulnerable code pattern (unbounded Map accumulation) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-31690",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.2-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:22856431-8a9e-5049-b55d-458f9125e4bc",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-31690 does not affect version 6.2.2-tuxcare.7 of org.springframework.security:spring-security-oauth2-client. The target Spring Security 6.2.2-tuxcare.9 is NOT AFFECTED by CVE-2022-31690. The vulnerability (automatic scope substitution when Authorization Server returns empty scope lists) was fixed by upstream Spring Security commits 75004587a4 and fde26e003a, both authored by sriesenberg@vmware.com. These fixes were already included in upstream Spring Security 6.2.2, which TuxCare onboarded. All affected token response clients now preserve empty scope lists as-is instead of replacing them with requested scopes, preventing privilege escalation attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), cve.org (>= 5.7, <= 5.7.4; >= 5.6, <= 5.6.8), Snyk (< 5.4.11; >= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.2-tuxcare.7"
    }
  ]
}