{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:05340a35-0aef-5247-b204-312782c80790",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-context",
      "purl": "pkg:maven/org.springframework/spring-context@6.1.14-tuxcare.2",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-context@6.1.14-tuxcare.2",
      "version": "6.1.14-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-context",
            "purl": "pkg:maven/org.springframework/spring-context@6.1.14",
            "type": "library",
            "group": "org.springframework",
            "version": "6.1.14"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2022-22968",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@6.1.14-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:3dd86742-5952-5d79-96cc-a19440d4d5a7",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22968 does not affect version 6.1.14-tuxcare.2 of org.springframework:spring-context. not_affected \u2014 The target Spring Framework version 6.1.14-tuxcare.3 is NOT affected by CVE-2022-22968. The vulnerability (case-sensitive disallowedFields pattern matching allowing field restriction bypass via case variations like \"Class\" vs \"class\") was fixed by upstream Spring Framework in commit a7cf19cec5ebd270f97a194d749e2d5701ad2ab7 on April 3, 2022, by Sam Brannen (sbrannen@vmware.com). This fix first a...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-38820",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@6.1.14-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:7f9943a3-655f-5911-ae04-71522895bf18",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-38820 does not affect version 6.1.14-tuxcare.2 of org.springframework:spring-context. The upstream fix was released in 6.1.14, and version 6.1.14 is a later release of the same line. Advisories: GitHub GHSA-4gc7-5j7h-4qph (fixed in 6.1.14), NVD (fixed in 6.1.14), CVE record (fixed in 6.1.14), Snyk (fixed in 6.1.14).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-22233",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@6.1.14-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:b2f18d89-38c8-57ff-a9a2-184b74c59fd3",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.1.14-tuxcare.2 of org.springframework:spring-context."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-context@6.1.14-tuxcare.2"
    }
  ]
}