{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:1d997b53-b465-5091-bdf2-31167ff98bf9",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-bom",
      "purl": "pkg:maven/org.springframework.security/spring-security-bom@5.6.3-tuxcare.1",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-bom@5.6.3-tuxcare.1",
      "version": "5.6.3-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-bom",
            "purl": "pkg:maven/org.springframework.security/spring-security-bom@5.6.3",
            "type": "library",
            "group": "org.springframework.security",
            "version": "5.6.3"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2021-22112",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-bom@5.6.3-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a0a40e52-51b9-5fe4-8bcf-449bf5d9f417",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-22112 does not affect version 5.6.3-tuxcare.1 of org.springframework.security:spring-security-bom. CVE-2021-22112 is NOT present in Spring Security 5.6.3. The vulnerability (SecurityContext not saved when changed multiple times in a single request) was fixed by upstream commit 3116369f in January 2021. This fix was already included in the upstream Spring Security 5.6.3 release that TuxCare onboarded. The target version is newer than all affected versions listed in the CVE (5.4.x < 5.4.4, 5.3.x < 5.3.8, 5.2.x < 5.2.9). The fix adds an isSaveContextInvoked flag to track multiple saveContext() calls and ensures the final SecurityContext is persisted, preventing privilege escalation scenarios where temporary elevated privileges would incorrectly persist.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-bom@5.6.3-tuxcare.1"
    }
  ]
}