{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:68c48558-e00a-546e-a6af-72222402d2a6",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring",
      "purl": "pkg:maven/org.springframework/spring@5.3.18-tuxcare.4",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring@5.3.18-tuxcare.4",
      "version": "5.3.18-tuxcare.4",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring",
            "purl": "pkg:maven/org.springframework/spring@5.3.18",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.18"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2010-1622",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.18-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:0e310378-02fd-5c4b-b9c4-528dfb1894f2",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2010-1622 does not affect version 5.3.18-tuxcare.4 of org.springframework:spring. not_affected \u2014 CVE-2010-1622 affects Spring Framework 2.5.x through 3.0.x, allowing remote code execution via HTTP parameters targeting class.classLoader.URLs[0]. The target (Spring Framework 5.3.18) is not affected because the upstream fix was applied in 2010 (commit 3a5af35d37 by Juergen Hoeller) and shipped with the upstream release. The defense code at lines 291-294 filters all Class.class properties exce...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-22096",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.18-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:0ffd3a89-2073-50cd-9efc-48b80369be13",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-22096 does not affect version 5.3.18-tuxcare.4 of org.springframework:spring. not_affected \u2014 CVE-2021-22096 (log injection via newline/control characters) is NOT present in Spring Framework 5.3.18. The upstream vendor (VMware/Pivotal) fixed this vulnerability in commits 99c7608ffe and e9083d7d, which were already included in the upstream 5.3.18 release. The fix sanitizes user input before logging by replacing newline characters with <EOL> and control characters with ? placeholders via ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-20860",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.18-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:9c529896-63d6-598e-830b-88d2833cc46b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-20860 affects version 5.3.18-tuxcare.4 of org.springframework:spring, and is fixed in 5.3.18-tuxcare.5."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring@5.3.18-tuxcare.4"
    }
  ]
}