{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:36bacc42-87e4-5879-827e-022c0547777d",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-cas",
      "purl": "pkg:maven/org.springframework.security/spring-security-cas@5.5.8-tuxcare.3",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-cas@5.5.8-tuxcare.3",
      "version": "5.5.8-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-cas",
            "purl": "pkg:maven/org.springframework.security/spring-security-cas@5.5.8",
            "type": "library",
            "group": "org.springframework.security",
            "version": "5.5.8"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2019-11272",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-cas@5.5.8-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:bd96e0e7-e6e9-5f08-866b-c947b35241bb",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-11272 does not affect version 5.5.8-tuxcare.3 of org.springframework.security:spring-security-cas. CVE-2019-11272 affects PlaintextPasswordEncoder in Spring Security versions 4.2.x up to 4.2.12 and older. The target repository (Spring Security 5.5.8) does not contain the vulnerable PlaintextPasswordEncoder class. This class was removed from Spring Security in version 5.0.0.RC1 (October 2017) by upstream maintainer Rob Winch, prior to the 5.5.8 release. The vulnerability allowed authentication bypass when a user had a null encoded password by matching the string \"null\", but since the vulnerable code does not exist in version 5.5.8, the target is not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-cas@5.5.8-tuxcare.3"
    }
  ]
}