{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:f6e754d0-6b5e-5009-9fab-b29330a69a09",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-context",
      "purl": "pkg:maven/org.springframework/spring-context@6.1.20-tuxcare.11",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-context@6.1.20-tuxcare.11",
      "version": "6.1.20-tuxcare.11",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-context",
            "purl": "pkg:maven/org.springframework/spring-context@6.1.20",
            "type": "library",
            "group": "org.springframework",
            "version": "6.1.20"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2022-22968",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@6.1.20-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:6a53637f-736d-5233-aaff-4f8fd41f8a9c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22968 does not affect version 6.1.20-tuxcare.11 of org.springframework:spring-context. not_affected \u2014 CVE-2022-22968 affects Spring Framework versions 5.3.0-5.3.18, 5.2.0-5.2.20, and older versions where disallowedFields patterns in DataBinder used case-sensitive matching, allowing attackers to bypass field protection using case variations. The target repository (Spring Framework 6.1.20-tuxcare.13) is NOT AFFECTED because the upstream release v6.1.20 already shipped with the fix. The vulnerabil...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-38820",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@6.1.20-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:7f30e05b-28c4-55ba-b675-bd08485bae2a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-38820 does not affect version 6.1.20-tuxcare.11 of org.springframework:spring-context. not_affected \u2014 The target repository (Spring Framework 6.1.20) is NOT AFFECTED by CVE-2024-38820. The vulnerability involved locale-dependent case conversion in DataBinder's disallowedFields pattern matching, which could allow bypassing field access restrictions in certain locales (e.g., Turkish where 'I' converts to '\u0131' instead of 'i'). The upstream release 6.1.20 fixed this by refactoring to use locale-inde...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-22233",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@6.1.20-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:4c6b18ce-c8e9-532b-952c-aaa9fb56bc38",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-22233 does not affect version 6.1.20-tuxcare.11 of org.springframework:spring-context. Version 6.1.20 is not affected by CVE-2025-22233: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-context@6.1.20-tuxcare.11"
    }
  ]
}