{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:3100a6d7-0b75-540b-83b3-31710fd035bd",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-context",
      "purl": "pkg:maven/org.springframework/spring-context@6.0.23-tuxcare.10",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-context@6.0.23-tuxcare.10",
      "version": "6.0.23-tuxcare.10",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-context",
            "purl": "pkg:maven/org.springframework/spring-context@6.0.23",
            "type": "library",
            "group": "org.springframework",
            "version": "6.0.23"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2022-22968",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@6.0.23-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:49e965f8-c8ee-566c-8b22-a93aff723b7d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22968 does not affect version 6.0.23-tuxcare.10 of org.springframework:spring-context. not_affected \u2014 Target version 6.0.23 is not affected by CVE-2022-22968. The vulnerability (case-sensitive disallowedFields pattern matching in DataBinder) was fixed in the upstream Spring Framework release that TuxCare onboarded. The fix (commit a7cf19cec5ebd270f97a194d749e2d5701ad2ab7 by Sam Brannen, April 2022) predates the first TuxCare commit on this branch and provides case-insensitive matching for disal...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-38820",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@6.0.23-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:4ec4629c-3da6-55df-aa85-64c0dd5c577b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38820 is fixed in version 6.0.23-tuxcare.10 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2025-22233",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@6.0.23-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:f53f6dcd-d532-5154-99e1-f8a6c6b0a419",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.0.23-tuxcare.10 of org.springframework:spring-context."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-context@6.0.23-tuxcare.10"
    }
  ]
}