{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:41f87b78-b9f0-5bd1-83a3-98eb5d5b6cbd",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-context",
      "purl": "pkg:maven/org.springframework/spring-context@6.1.18-tuxcare.1",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-context@6.1.18-tuxcare.1",
      "version": "6.1.18-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-context",
            "purl": "pkg:maven/org.springframework/spring-context@6.1.18",
            "type": "library",
            "group": "org.springframework",
            "version": "6.1.18"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2022-22968",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@6.1.18-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:17805003-db93-53b2-b84e-f3e74598e9ad",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22968 does not affect version 6.1.18-tuxcare.1 of org.springframework:spring-context. not_affected \u2014 Spring Framework 6.1.18 is not affected by CVE-2022-22968. The vulnerability involved case-sensitive matching of disallowedFields patterns in DataBinder, allowing attackers to bypass field protection by varying case (e.g., \"Password\" vs \"password\"). The fix was already present in the upstream Spring Framework 6.1.18 release, which uses case-insensitive pattern matching via PatternMatchUtils.sim...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-38820",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@6.1.18-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9124ee0f-fa14-51bc-a6d7-bb70c2462846",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-38820 does not affect version 6.1.18-tuxcare.1 of org.springframework:spring-context. The upstream fix was released in 6.1.14, and version 6.1.18 is a later release of the same line. Advisories: GitHub GHSA-4gc7-5j7h-4qph (fixed in 6.1.14), NVD (fixed in 6.1.14), CVE record (fixed in 6.1.14), Snyk (fixed in 6.1.14).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-22233",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@6.1.18-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a68529a4-19df-5145-b5f7-0a94d5254dc8",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.1.18-tuxcare.1 of org.springframework:spring-context."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-context@6.1.18-tuxcare.1"
    }
  ]
}