{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:6c1aa9e9-7401-5a39-b0c7-470f0b94a909",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-cas",
      "purl": "pkg:maven/org.springframework.security/spring-security-cas@5.6.5-tuxcare.3",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-cas@5.6.5-tuxcare.3",
      "version": "5.6.5-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-cas",
            "purl": "pkg:maven/org.springframework.security/spring-security-cas@5.6.5",
            "type": "library",
            "group": "org.springframework.security",
            "version": "5.6.5"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2019-11272",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-cas@5.6.5-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:d95ea82e-194c-50b1-b0cd-e81ef83d7770",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-11272 does not affect version 5.6.5-tuxcare.3 of org.springframework.security:spring-security-cas. CVE-2019-11272 affects PlaintextPasswordEncoder in Spring Security versions 4.2.x up to 4.2.12 and older. The target version 5.6.5 is NOT AFFECTED because PlaintextPasswordEncoder was completely removed from Spring Security in version 5.0.0.RC1 (October 2017). The vulnerable class does not exist in the target repository at HEAD. The CVE's affected version range explicitly excludes Spring Security 5.x and later versions.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-cas@5.6.5-tuxcare.3"
    }
  ]
}