{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:4301febd-2719-5291-905e-5287535803ff",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-oauth2-client",
      "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.6.7-tuxcare.6",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.6.7-tuxcare.6",
      "version": "5.6.7-tuxcare.6",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-oauth2-client",
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.6.7",
            "type": "library",
            "group": "org.springframework.security",
            "version": "5.6.7"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2021-22119",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.6.7-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:7e33e7aa-6f4c-5d02-a544-b07cb55e61c5",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-22119 does not affect version 5.6.7-tuxcare.6 of org.springframework.security:spring-security-oauth2-client. Target version 5.6.7 is not affected by CVE-2021-22119. The vulnerable pattern (unbounded accumulation of OAuth2 authorization requests in HTTP session) was fixed in upstream Spring Security 5.5.1 via commit 35f5ebdbcf93aa380cd57ca5ef7d579ed53f2a71, authored by Craig Andrews. The fix limits storage to one authorization request per session by default, preventing the DoS attack. The target contains this upstream fix since it was part of the 5.6.7 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-31690",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.6.7-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:76c008cd-3ca8-53a0-aa36-ae64e41364c1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-31690 affects version 5.6.7-tuxcare.6 of org.springframework.security:spring-security-oauth2-client."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.6.7-tuxcare.6"
    }
  ]
}