{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:640e3e16-0290-5022-84db-030a09fb5f51",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring",
      "purl": "pkg:maven/org.springframework/spring@5.3.33-tuxcare.5",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring@5.3.33-tuxcare.5",
      "version": "5.3.33-tuxcare.5",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring",
            "purl": "pkg:maven/org.springframework/spring@5.3.33",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.33"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2010-1622",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.33-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:8cdc547d-f974-5fb1-9453-1400a861393b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2010-1622 does not affect version 5.3.33-tuxcare.5 of org.springframework:spring. not_affected \u2014 CVE-2010-1622 is NOT present in Spring Framework 5.3.33. The vulnerability allowed remote code execution via property binding to class.classLoader.URLs[0], enabling attackers to load malicious JAR files. The upstream vendor (Spring/VMware) fixed this in 2010 via commit 3a5af35d37 (SPR-7227), which explicitly filters the classLoader property from bindable properties. This fix was already present...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-22096",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.33-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:e43defd2-388c-5685-bf32-f38bb4947a0d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-22096 does not affect version 5.3.33-tuxcare.5 of org.springframework:spring. not_affected \u2014 CVE-2021-22096 (log injection via newline/control characters) is NOT present in Spring Framework 5.3.33. The vulnerability affects versions 5.3.0-5.3.10, 5.2.0-5.2.17, and older versions. Target version 5.3.33 already contains the upstream vendor fix (commit 99c7608f by rstoyanchev@vmware.com) that sanitizes newlines and control characters in logged user input via LogFormatUtils. The fix was sh...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-20860",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.33-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:fd6e6971-1240-5587-8725-bc22fa6ec09c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-20860 does not affect version 5.3.33-tuxcare.5 of org.springframework:spring. CVE-2023-20860 is NOT present in Spring Framework 5.3.33. The vulnerability involved pattern matching mismatches when using \"**\" patterns in Spring Security configuration with mvcRequestMatcher, potentially allowing security bypasses. The upstream fix (commit 1cd994d3a8) was already included in the upstream 5.3.33 release, which TuxCare onboarded. The fix normalizes URL patterns by prepending \"/\" to patterns lacking a leading slash, implemented via the PathPatternParser.initFullPathPattern() method called from LookupPathMatchableHandlerMapping.match().\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.0.0, < 6.0.7; >= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7; >= 5.3.0, < 5.3.26), NVD (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7), cve.org (>= 6.0.0, <= 6.0.6; >= 5.3.0, <= 5.3.25), Snyk (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring@5.3.33-tuxcare.5"
    }
  ]
}