{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:15680b53-27e2-517b-b2e5-618ba5377974",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-oauth2-client",
      "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.3.9-tuxcare.3",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.3.9-tuxcare.3",
      "version": "6.3.9-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-oauth2-client",
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.3.9",
            "type": "library",
            "group": "org.springframework.security",
            "version": "6.3.9"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2021-22119",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.3.9-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:5a76e071-11c6-5554-aa9a-9f8f47bc4cc8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-22119 does not affect version 6.3.9-tuxcare.3 of org.springframework.security:spring-security-oauth2-client. CVE-2021-22119: Spring Security 6.3.9-tuxcare.2 is NOT AFFECTED. The vulnerability (unbounded accumulation of OAuth2 authorization requests in session storage leading to DoS) does not exist in the target. The fix was already present in the upstream Spring Security 6.3.9 release when TuxCare onboarded it. The target stores exactly ONE authorization request per session (no Map-based accumulation), preventing resource exhaustion. Both HttpSession (Servlet/Web) and WebSession (WebFlux/Reactive) implementations contain the upstream fix authored by Craig Andrews (commit 35f5ebdbcf). This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-31690",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.3.9-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:6cccde16-0838-5580-8c44-ec40cc95dcbd",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-31690 does not affect version 6.3.9-tuxcare.3 of org.springframework.security:spring-security-oauth2-client. Spring Security 6.3.9 is not affected by CVE-2022-31690. The vulnerability affects versions 5.6 prior to 5.6.9 and 5.7 prior to 5.7.5. The target version 6.3.9 includes upstream fixes (commits 75004587a4 and fde26e003a) authored by Steve Riesenberg that shipped with the upstream release before TuxCare onboarding. The vulnerable automatic scope-filling logic has been removed, and the code now preserves empty scope lists as returned by the Authorization Server, preventing privilege escalation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), cve.org (>= 5.7, <= 5.7.4; >= 5.6, <= 5.6.8), Snyk (< 5.4.11; >= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.3.9-tuxcare.3"
    }
  ]
}