{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:95cb51dc-baa4-529d-9c97-5219a756bac2",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-cas",
      "purl": "pkg:maven/org.springframework.security/spring-security-cas@6.4.13-tuxcare.9",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-cas@6.4.13-tuxcare.9",
      "version": "6.4.13-tuxcare.9",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-cas",
            "purl": "pkg:maven/org.springframework.security/spring-security-cas@6.4.13",
            "type": "library",
            "group": "org.springframework.security",
            "version": "6.4.13"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2019-11272",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.4.13-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:4742f4f1-896d-578f-adf1-d9629cab7b9f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-11272 does not affect version 6.4.13-tuxcare.9 of org.springframework.security:spring-security-cas. The target Spring Security version 6.4.13 is not affected by CVE-2019-11272. The vulnerable class PlaintextPasswordEncoder was removed from Spring Security core in version 5.0 (October 2017, commit 12dbf2e961) by upstream maintainer Rob Winch. This removal predates version 6.4.13 and was part of the upstream release that TuxCare onboarded. The class does not exist in the target repository, making the vulnerability impossible to exploit. CVE-2019-11272 affects only Spring Security 4.2.x up to 4.2.12 and older unsupported versions.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.4.13-tuxcare.9"
    }
  ]
}