{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:04e497c0-8c90-55fd-89d3-fb6d03b71f33",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring",
      "purl": "pkg:maven/org.springframework/spring@5.3.19-tuxcare.1",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring@5.3.19-tuxcare.1",
      "version": "5.3.19-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring",
            "purl": "pkg:maven/org.springframework/spring@5.3.19",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.19"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2010-1622",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.19-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:aeff3d3b-898d-569f-a4b0-ced782bb9002",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2010-1622 does not affect version 5.3.19-tuxcare.1 of org.springframework:spring. not_affected \u2014 CVE-2010-1622 is NOT present in Spring Framework 5.3.19. The vulnerability allowed remote attackers to execute arbitrary code via HTTP requests containing `class.classLoader.URLs[0]=jar:...` to load malicious JARs. The upstream Spring team fixed this in commit 3a5af35d37 (SPR-7227) by filtering the classLoader property from Class introspection, which shipped in Spring Framework 3.0.3. The targe...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-22096",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.19-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:063b2e0d-5821-59ce-83ca-d3a312e65a56",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-22096 does not affect version 5.3.19-tuxcare.1 of org.springframework:spring. not_affected \u2014 Spring Framework 5.3.19 is NOT affected by CVE-2021-22096 (log injection vulnerability). The fix for this vulnerability was already included in the upstream Spring Framework 5.3.19 release (released April 13, 2022). The upstream patches by Rossen Stoyanchev (VMware) added sanitization of newlines and control characters in LogFormatUtils (commit 99c7608f, Dec 8, 2021) and applied this sanitizati...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-20860",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.19-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:5d3fb6a5-d228-56d5-8037-4b70180083c3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-20860 affects version 5.3.19-tuxcare.1 of org.springframework:spring, and is fixed in 5.3.19-tuxcare.4."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring@5.3.19-tuxcare.1"
    }
  ]
}