{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:18bde882-d389-5667-b984-4cb05c618db8",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring",
      "purl": "pkg:maven/org.springframework/spring@5.3.20-tuxcare.4",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring@5.3.20-tuxcare.4",
      "version": "5.3.20-tuxcare.4",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring",
            "purl": "pkg:maven/org.springframework/spring@5.3.20",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.20"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2010-1622",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.20-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:b28d2137-814b-5b11-81d7-746c67ca5cb6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2010-1622 does not affect version 5.3.20-tuxcare.4 of org.springframework:spring. not_affected \u2014 CVE-2010-1622 is not present in Spring Framework 5.3.20. The vulnerability allowed RCE via HTTP request parameters binding to class.classLoader.URLs[0]. The upstream fix (commit 002546b3e4b8d791ea6acccb81eb3168f51abb15 by Brian Clozel, 2022-03-31) was already included in the Spring Framework 5.3.20 release (2022-05-11) that TuxCare onboarded. The fix implements a whitelist approach in CachedInt...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-22096",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.20-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:f63bbba2-0aec-5f5d-80f6-e53120c783ed",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-22096 does not affect version 5.3.20-tuxcare.4 of org.springframework:spring. not_affected \u2014 CVE-2021-22096 (log injection via newline/control characters) is NOT present in Spring Framework 5.3.20. The upstream fix was applied in December 2021 (commits 99c7608ffe and e9083d7d20) and first shipped in version 5.3.14. The target version 5.3.20 includes this fix as part of the upstream release. The vulnerability pattern (unfiltered user input in log statements) is not present - all user-co...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-20860",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.20-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:ca07f567-a627-5dc9-b326-4fc5b4322290",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-20860 is fixed in version 5.3.20-tuxcare.4 of org.springframework:spring."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring@5.3.20-tuxcare.4"
    }
  ]
}