{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:1418c7b2-1e96-52df-8b4f-ef4721b8e777",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-context",
      "purl": "pkg:maven/org.springframework/spring-context@5.3.23-tuxcare.2",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-context@5.3.23-tuxcare.2",
      "version": "5.3.23-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-context",
            "purl": "pkg:maven/org.springframework/spring-context@5.3.23",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.23"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2022-22968",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.23-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:2d0ab423-940e-567a-ae74-45ec66c296ae",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22968 does not affect version 5.3.23-tuxcare.2 of org.springframework:spring-context. not_affected \u2014 CVE-2022-22968 (case-sensitive disallowed field pattern matching bypass) is NOT present in the target. The fix was already included in the upstream Spring Framework 5.3.23 release (commit a7cf19ce by Sam Brannen) before TuxCare onboarded it. The vulnerable pattern (case-sensitive matching that allows \"Id\" to bypass \"id\" disallowed pattern) does not exist. The current HEAD uses PatternMatchUtils...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-38820",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.23-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:48e6fc79-3eca-5003-bc35-eefb08e50433",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.23-tuxcare.2 of org.springframework:spring-context."
      }
    },
    {
      "id": "CVE-2025-22233",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@5.3.23-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a36f0cce-cec9-5f8b-8685-1ee379d96bb0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-22233 affects version 5.3.23-tuxcare.2 of org.springframework:spring-context, and is fixed in 5.3.23-tuxcare.3."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-context@5.3.23-tuxcare.2"
    }
  ]
}