{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:5cf0cc65-d9e4-5f59-bc84-8ecfbf7ce814",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-cas",
      "purl": "pkg:maven/org.springframework.security/spring-security-cas@6.1.5-tuxcare.3",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-cas@6.1.5-tuxcare.3",
      "version": "6.1.5-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-cas",
            "purl": "pkg:maven/org.springframework.security/spring-security-cas@6.1.5",
            "type": "library",
            "group": "org.springframework.security",
            "version": "6.1.5"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2019-11272",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.1.5-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:46374915-a682-50f9-bf9f-3471728b77b1",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-11272 does not affect version 6.1.5-tuxcare.3 of org.springframework.security:spring-security-cas. Spring Security 6.1.5 is not affected by CVE-2019-11272. The vulnerable class PlaintextPasswordEncoder was completely removed from Spring Security in version 5.0.0 RC1 (October 2017, commit 12dbf2e961), well before version 6.1.5 was released. The CVE affects versions 4.2.x up to 4.2.12 and older unsupported versions that still contained PlaintextPasswordEncoder. Modern Spring Security 6.x uses cryptographic password encoders (BCrypt, PBKDF2, SCrypt, Argon2) in the crypto module with a different API (matches() instead of isPasswordValid()), and these do not have the null password vulnerability. The removal was done by upstream Spring Security, not TuxCare, and shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.1.5-tuxcare.3"
    }
  ]
}