{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:3628b1a9-aef7-5dee-9ce3-92d720e05178",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-cas",
      "purl": "pkg:maven/org.springframework.security/spring-security-cas@6.3.10-tuxcare.18",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-cas@6.3.10-tuxcare.18",
      "version": "6.3.10-tuxcare.18",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-cas",
            "purl": "pkg:maven/org.springframework.security/spring-security-cas@6.3.10",
            "type": "library",
            "group": "org.springframework.security",
            "version": "6.3.10"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2019-11272",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.3.10-tuxcare.18"
        }
      ],
      "bom-ref": "urn:uuid:81fa72d9-9f05-5d12-960f-b8fcddfb59ea",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-11272 does not affect version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-cas. Spring Security 6.3.10 is NOT affected by CVE-2019-11272. The vulnerable class PlaintextPasswordEncoder does not exist in this version - it was removed in Spring Security 5.0 (October 2017) as part of upstream architectural changes, years before the CVE was discovered in June 2019. The CVE only affects versions 4.2.x and older. The removal was an upstream change by Rob Winch that shipped in the upstream release TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.3.10-tuxcare.18"
    }
  ]
}