{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:8331e283-1d81-53d6-8f2e-d3d116745f25",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-context",
      "purl": "pkg:maven/org.springframework/spring-context@6.1.7-tuxcare.9",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-context@6.1.7-tuxcare.9",
      "version": "6.1.7-tuxcare.9",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-context",
            "purl": "pkg:maven/org.springframework/spring-context@6.1.7",
            "type": "library",
            "group": "org.springframework",
            "version": "6.1.7"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2022-22968",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@6.1.7-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:e495c2f7-076e-5b9e-af97-3c0983001cf2",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22968 does not affect version 6.1.7-tuxcare.9 of org.springframework:spring-context. not_affected \u2014 Spring Framework 6.1.7 is not affected by CVE-2022-22968. The vulnerability (case-sensitive disallowed field pattern matching in DataBinder) was fixed in upstream Spring Framework 5.2.21 and 5.3.19 (April 2022). Spring Framework 6.1.7, released much later, already contains this fix. The target code converts both disallowed field patterns and incoming field names to lowercase before matching, ma...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-38820",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@6.1.7-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:e8a2b3e9-e7cf-5dce-866d-30dc7e016cfa",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38820 is fixed in version 6.1.7-tuxcare.9 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2025-22233",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@6.1.7-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:48b6ab46-d3ea-5fea-9b41-a513b388dc41",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-22233 affects version 6.1.7-tuxcare.9 of org.springframework:spring-context."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-context@6.1.7-tuxcare.9"
    }
  ]
}