{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:a76531b5-fad5-5d87-9f1d-eaac3edc368b",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-bom",
      "purl": "pkg:maven/org.springframework.security/spring-security-bom@6.2.8-tuxcare.7",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-bom@6.2.8-tuxcare.7",
      "version": "6.2.8-tuxcare.7",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-bom",
            "purl": "pkg:maven/org.springframework.security/spring-security-bom@6.2.8",
            "type": "library",
            "group": "org.springframework.security",
            "version": "6.2.8"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2021-22112",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-bom@6.2.8-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:0dded406-8c1f-5028-9fc9-6c905ff7f0c9",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-22112 does not affect version 6.2.8-tuxcare.7 of org.springframework.security:spring-security-bom. CVE-2021-22112 affects Spring Security versions where HttpSessionSecurityContextRepository fails to save the SecurityContext when changed multiple times in a single request. The target repository (Spring Security 6.2.8) contains the upstream fix committed by Rob Winch (7cab7b06c5) which shipped in the upstream release before TuxCare onboarding. The vulnerable pattern is absent: the code no longer checks isContextSaved() to prevent multiple saves, and instead uses isSaveContextInvoked flag to track changes and ensure subsequent context modifications are saved correctly.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-bom@6.2.8-tuxcare.7"
    }
  ]
}