{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:d2a910d1-3c4e-5105-bc21-33d39dc6689e",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-bom",
      "purl": "pkg:maven/org.springframework.security/spring-security-bom@6.4.13-tuxcare.8",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-bom@6.4.13-tuxcare.8",
      "version": "6.4.13-tuxcare.8",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-bom",
            "purl": "pkg:maven/org.springframework.security/spring-security-bom@6.4.13",
            "type": "library",
            "group": "org.springframework.security",
            "version": "6.4.13"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2021-22112",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-bom@6.4.13-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:406cccec-f535-53f9-8f2c-1e795c20c592",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-22112 does not affect version 6.4.13-tuxcare.8 of org.springframework.security:spring-security-bom. Spring Security 6.4.13 is not affected by CVE-2021-22112. The vulnerability was fixed in upstream Spring Security versions 5.4.4, 5.3.8, and 5.2.9 (released in early 2021). Version 6.4.13 includes the upstream fix that prevents SecurityContext from failing to save when changed multiple times in a single request. The fix (commit c72a6fac04) introduced the isSaveContextInvoked flag mechanism, which is present in the target code at lines 358, 409, 429, and 435 of HttpSessionSecurityContextRepository.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-bom@6.4.13-tuxcare.8"
    }
  ]
}