{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:72d46492-8c66-516c-8d5b-83218b16f8d9",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-context",
      "purl": "pkg:maven/org.springframework/spring-context@6.0.13-tuxcare.5",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-context@6.0.13-tuxcare.5",
      "version": "6.0.13-tuxcare.5",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-context",
            "purl": "pkg:maven/org.springframework/spring-context@6.0.13",
            "type": "library",
            "group": "org.springframework",
            "version": "6.0.13"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2022-22968",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@6.0.13-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:a609996a-1148-561e-b1e3-449ebbe94692",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22968 does not affect version 6.0.13-tuxcare.5 of org.springframework:spring-context. not_affected \u2014 CVE-2022-22968 is NOT present in Spring Framework 6.0.13-tuxcare.6. The vulnerability involved case-sensitive matching in DataBinder's disallowedFields patterns, allowing attackers to bypass field restrictions by varying the case of field names (e.g., \"Field\" instead of \"field\"). The fix, which converts both disallowed patterns and incoming field names to lowercase for case-insensitive matching...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-38820",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@6.0.13-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:682486db-65c7-532d-9905-2e87247be449",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-38820 affects version 6.0.13-tuxcare.5 of org.springframework:spring-context, and is fixed in 6.0.13-tuxcare.8."
      }
    },
    {
      "id": "CVE-2025-22233",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@6.0.13-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:d63ac2d3-dc6e-5697-99e4-8edd97372720",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-22233 affects version 6.0.13-tuxcare.5 of org.springframework:spring-context, and is fixed in 6.0.13-tuxcare.9."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-context@6.0.13-tuxcare.5"
    }
  ]
}