{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:ac87fcb2-338f-5b9b-aa99-0357c413a761",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-oauth2-client",
      "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.6.9-tuxcare.3",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.6.9-tuxcare.3",
      "version": "5.6.9-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-oauth2-client",
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.6.9",
            "type": "library",
            "group": "org.springframework.security",
            "version": "5.6.9"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2021-22119",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.6.9-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:0777e13f-1abd-55d2-9784-bd4e01aa7626",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-22119 does not affect version 5.6.9-tuxcare.3 of org.springframework.security:spring-security-oauth2-client. CVE-2021-22119 DoS vulnerability via unlimited OAuth2 authorization request accumulation is NOT present in target Spring Security 5.6.9. The upstream vendor (Spring Security project) applied the fix in version 5.5.1 (commit 35f5ebdbcf, 2021-04-22) before TuxCare onboarded version 5.6.9 (2026-09-14). The fix limits authorization requests to one per session by default via the allowMultipleAuthorizationRequests flag, preventing resource exhaustion attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-31690",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.6.9-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:087c4959-e159-5ec5-bef8-f9ab2509e00c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-31690 does not affect version 5.6.9-tuxcare.3 of org.springframework.security:spring-security-oauth2-client. CVE-2022-31690: Spring Security OAuth2 privilege escalation via empty scope auto-filling. The target repository (Spring Security 5.6.9) is NOT AFFECTED. The vulnerable code pattern that automatically replaced empty scopes from the Authorization Server with originally requested scopes has been removed. The fix was included in the upstream Spring Security 5.6.9 release (commit 75004587a4 \"Fix scope mapping\" by sriesenberg@vmware.com) before TuxCare onboarded this version. All affected token response clients (DefaultAuthorizationCodeTokenResponseClient, DefaultPasswordTokenResponseClient, DefaultClientCredentialsTokenResponseClient, and their reactive counterparts) now return the Authorization Server's response as-is without scope manipulation, preventing privilege escalation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), cve.org (>= 5.7, <= 5.7.4; >= 5.6, <= 5.6.8), Snyk (< 5.4.11; >= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.6.9-tuxcare.3"
    }
  ]
}