{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:4ccde520-fd56-54c8-9a8f-2e443e470647",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-oauth2-client",
      "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.5.11-tuxcare.4",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.5.11-tuxcare.4",
      "version": "6.5.11-tuxcare.4",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-oauth2-client",
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.5.11",
            "type": "library",
            "group": "org.springframework.security",
            "version": "6.5.11"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2021-22119",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.5.11-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:6b4acc20-95f2-5b24-9738-b6192103e207",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-22119 does not affect version 6.5.11-tuxcare.4 of org.springframework.security:spring-security-oauth2-client. The target Spring Security 6.5.11-tuxcare.4 is NOT affected by CVE-2021-22119. The vulnerability (DoS via unlimited accumulation of OAuth2 authorization requests in session storage) has been fixed by upstream commit 35f5ebdbcf, which was already present in the Spring Security 6.5.11 release that TuxCare onboarded. The target uses single-request storage that overwrites previous requests, preventing the resource exhaustion attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-31690",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.5.11-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:619a9888-6d08-59e9-9d76-e600396825bb",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-31690 does not affect version 6.5.11-tuxcare.4 of org.springframework.security:spring-security-oauth2-client. The target repository (Spring Security 6.5.11) is not affected by CVE-2022-31690. The vulnerability involved automatic backfilling of empty OAuth2 scope responses with client-requested scopes, leading to privilege escalation. Both upstream fix commits (75004587a4 \"Fix scope mapping\" and fde26e003a \"Request user info when AS returns no scopes\") are present in the target and shipped in the upstream Spring Security 6.5.11 release. The fixes were authored by sriesenberg@vmware.com (upstream) and are ancestors of the first TuxCare onboarding commit (bdf9128d7f). All six token response client classes have been verified to contain the fixes, with no vulnerable backfilling logic present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), cve.org (>= 5.7, <= 5.7.4; >= 5.6, <= 5.6.8), Snyk (< 5.4.11; >= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.5.11-tuxcare.4"
    }
  ]
}