{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:ad292983-db2e-50a1-ac41-51b269832a48",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring",
      "purl": "pkg:maven/org.springframework/spring@5.3.27-tuxcare.10",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring@5.3.27-tuxcare.10",
      "version": "5.3.27-tuxcare.10",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring",
            "purl": "pkg:maven/org.springframework/spring@5.3.27",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.27"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2010-1622",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.27-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:891574f5-eab9-5eda-b87e-e1904556e527",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2010-1622 does not affect version 5.3.27-tuxcare.10 of org.springframework:spring. not_affected \u2014 CVE-2010-1622 is NOT present in Spring Framework 5.3.27-tuxcare.10. The vulnerability allowed remote code execution via HTTP parameter binding to class.classLoader.URLs[0]. The upstream fix (commit 3a5af35d37 by Juergen Hoeller, May 2010) blocks the classLoader property during Class introspection and was already present in the Spring Framework 5.3.27 release that TuxCare onboarded. The current ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-22096",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.27-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:bbfa6244-9e59-5dd6-be9f-28cb1e772851",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-22096 does not affect version 5.3.27-tuxcare.10 of org.springframework:spring. not_affected \u2014 The target (Spring Framework 5.3.27-tuxcare.10) is NOT affected by CVE-2021-22096 (log injection vulnerability). The vulnerability allowed attackers to inject newline and control characters into log entries, creating forged log entries. The upstream fix was already present in the base release v5.3.14 that TuxCare onboarded, before any TuxCare modifications. Both key fix commits (99c7608ffe addi...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-20860",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.27-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:5aff2c62-4d86-5d36-8862-4a04d3813464",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-20860 does not affect version 5.3.27-tuxcare.10 of org.springframework:spring. CVE-2023-20860 is not present in target version 5.3.27. The vulnerability involved a pattern matching mismatch between Spring Security and Spring MVC when using \"**\" patterns with mvcRequestMatcher, allowing security bypasses. The fix (pattern normalization by prepending \"/\" to patterns without leading slash) was introduced in upstream commit eafe3afe11c9fc440ce3088e7e45ecaeffb57a52 by rstoyanchev@vmware.com and shipped in the upstream Spring Framework 5.3.27 release before TuxCare's onboarding (first TuxCare commit: 035314f7275469663f61e2bae65b66a2a36340dd). The fix is present at HandlerMappingIntrospector.java:333 and is unconditionally active.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.0.0, < 6.0.7; >= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7; >= 5.3.0, < 5.3.26), NVD (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7), cve.org (>= 6.0.0, <= 6.0.6; >= 5.3.0, <= 5.3.25), Snyk (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring@5.3.27-tuxcare.10"
    }
  ]
}