{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:fa4a85f1-d38e-55fe-be21-9a2f44957715",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-oauth2-client",
      "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.7.7-tuxcare.1",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.7.7-tuxcare.1",
      "version": "5.7.7-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-oauth2-client",
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.7.7",
            "type": "library",
            "group": "org.springframework.security",
            "version": "5.7.7"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2021-22119",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.7.7-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:6995f125-ff51-5748-9680-23f6d318c8a6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-22119 does not affect version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-client. The target repository (spring-security 5.7.7-tuxcare.3) is not affected by CVE-2021-22119. The fix for this DoS vulnerability was already present in the upstream release 5.7.7 that TuxCare onboarded. The vulnerable pattern (unbounded accumulation of OAuth2 authorization requests in session storage) has been removed by commit 35f5ebdbcf authored by the upstream Spring Security team.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-31690",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.7.7-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f8dd5703-2ad0-536f-96f1-bdb77f4a9851",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-31690 does not affect version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-client. The target Spring Security 5.7.7-tuxcare.3 is not affected by CVE-2022-31690. The vulnerability (privilege escalation through empty OAuth2 scope handling) was fixed in upstream Spring Security 5.7.5. The target version 5.7.7 already contains the upstream fixes (commits 75004587a4 and fde26e003a by Steve Riesenberg, dated October-November 2022), which were part of the upstream release onboarded by TuxCare. All affected token response clients (DefaultAuthorizationCodeTokenResponseClient, DefaultClientCredentialsTokenResponseClient, DefaultPasswordTokenResponseClient, and their reactive counterparts) no longer default empty scopes to requested scopes, preventing the privilege escalation attack. The OidcUserService also includes the fix to request user info when scopes are empty.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), cve.org (>= 5.7, <= 5.7.4; >= 5.6, <= 5.6.8), Snyk (< 5.4.11; >= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.7.7-tuxcare.1"
    }
  ]
}