{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:4da402ac-9c7c-57d7-8bbd-05ffceecc319",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-cas",
      "purl": "pkg:maven/org.springframework.security/spring-security-cas@6.4.3-tuxcare.14",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-cas@6.4.3-tuxcare.14",
      "version": "6.4.3-tuxcare.14",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-cas",
            "purl": "pkg:maven/org.springframework.security/spring-security-cas@6.4.3",
            "type": "library",
            "group": "org.springframework.security",
            "version": "6.4.3"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2019-11272",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.4.3-tuxcare.14"
        }
      ],
      "bom-ref": "urn:uuid:316dbad6-319f-5e25-9098-fa85a590637c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-11272 does not affect version 6.4.3-tuxcare.14 of org.springframework.security:spring-security-cas. Spring Security version 6.4.3 is not affected by CVE-2019-11272. The vulnerable component PlaintextPasswordEncoder was removed from Spring Security in version 5.0.0 (October 2017, commit 12dbf2e961) by upstream maintainer Rob Winch, years before version 6.4.3 was released. The target version never contained the vulnerable code and uses modern, secure password encoders (BCrypt, Argon2, Pbkdf2) that properly handle null encoded passwords.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.2.13; < 4.2.13.RELEASE), NVD (< 4.2.13), cve.org (>= 4.2, < 4.2.13.RELEASE), Snyk (>= 4.2.0.RELEASE, < 4.2.13.RELEASE).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.4.3-tuxcare.14"
    }
  ]
}