{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:84f85873-1232-55d8-a9d6-a1767b553412",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-cas",
      "purl": "pkg:maven/org.springframework.security/spring-security-cas@5.7.14-tuxcare.12",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-cas@5.7.14-tuxcare.12",
      "version": "5.7.14-tuxcare.12",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-cas",
            "purl": "pkg:maven/org.springframework.security/spring-security-cas@5.7.14",
            "type": "library",
            "group": "org.springframework.security",
            "version": "5.7.14"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2007-1651",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-cas@5.7.14-tuxcare.12"
        }
      ],
      "bom-ref": "urn:uuid:b775d79b-d351-5afe-ba1a-608a59f743c3",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2007-1651 is a false positive for org.springframework.security:spring-security-cas 5.7.14-tuxcare.12. direct vulnerability is in OpenID project"
      }
    },
    {
      "id": "CVE-2007-1652",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-cas@5.7.14-tuxcare.12"
        }
      ],
      "bom-ref": "urn:uuid:db874603-5670-5d31-980a-8c0772f9ac63",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2007-1652 is a false positive for org.springframework.security:spring-security-cas 5.7.14-tuxcare.12. direct vulnerability is in OpenID project"
      }
    },
    {
      "id": "CVE-2019-11272",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-cas@5.7.14-tuxcare.12"
        }
      ],
      "bom-ref": "urn:uuid:da43d612-ea36-5afa-b70f-f9eb9d1787ac",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-11272 does not affect version 5.7.14-tuxcare.12 of org.springframework.security:spring-security-cas. Spring Security 5.7.14 is not affected by CVE-2019-11272. The vulnerable component (PlaintextPasswordEncoder) was removed from Spring Security 5.0 in October 2017 (commit 12dbf2e9612c), well before the CVE was published in June 2019. The CVE affects versions 4.2.x up to 4.2.12 and older unsupported versions. Version 5.7.14 is from the 5.x series which replaced the deprecated authentication.encoding package with the crypto.password package. The removal was part of the upstream release and was authored by Rob Winch (upstream), not by TuxCare/CloudLinux.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-cas@5.7.14-tuxcare.12"
    }
  ]
}