{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:fb928f88-4679-5584-8b9e-f84f10c1dd31",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring",
      "purl": "pkg:maven/org.springframework/spring@5.3.30-tuxcare.13",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring@5.3.30-tuxcare.13",
      "version": "5.3.30-tuxcare.13",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring",
            "purl": "pkg:maven/org.springframework/spring@5.3.30",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.30"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2010-1622",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.30-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:419ec690-bcaa-5ca1-9d0f-4f300bf93202",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2010-1622 does not affect version 5.3.30-tuxcare.13 of org.springframework:spring. not_affected \u2014 Target Spring Framework 5.3.30-tuxcare.12 is NOT AFFECTED by CVE-2010-1622. The vulnerability (arbitrary code execution via HTTP parameter `class.classLoader.URLs[0]=jar:...`) was fixed in upstream commit 3a5af35d37 (May 2010) by Juergen Hoeller, which shipped in the upstream release before TuxCare onboarding. The target implements multiple defenses: (1) lines 302-306 of CachedIntrospectionResu...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-22096",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.30-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:b510b24a-39b7-50db-8378-11fcc0d013a8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-22096 does not affect version 5.3.30-tuxcare.13 of org.springframework:spring. not_affected \u2014 CVE-2021-22096 (log injection via newlines/control characters) is not present in Spring Framework 5.3.30. The upstream vendor fix was already included in the 5.3.14 release (Dec 2021), well before version 5.3.30. The fix adds LogFormatUtils sanitization that replaces newlines with <EOL> and control characters with '?' before logging user-controlled data. All vulnerable code paths have been reme...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-20860",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.30-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:d21bf2b3-5478-5090-9679-32437b9e1cc8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-20860 does not affect version 5.3.30-tuxcare.13 of org.springframework:spring. CVE-2023-20860 is NOT present in Spring Framework 5.3.30. The vulnerability involved pattern matching mismatch between Spring Security and Spring MVC when using patterns without a leading \"/\" (e.g., \"**\"). The fix normalizes patterns by prepending \"/\" when absent via PathPatternParser.initFullPathPattern(). This fix was introduced by upstream vendor (rstoyanchev@vmware.com) in commit 1cd994d3a8 on July 11, 2023, included in upstream release v5.3.29, and was already present when TuxCare onboarded v5.3.30 in October 2025. The defense is active at HandlerMappingIntrospector.match() line 339, protecting the Spring Security mvcRequestMatcher integration path.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.0.0, < 6.0.7; >= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7; >= 5.3.0, < 5.3.26), NVD (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7), cve.org (>= 6.0.0, <= 6.0.6; >= 5.3.0, <= 5.3.25), Snyk (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring@5.3.30-tuxcare.13"
    }
  ]
}