{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:01fb8ecd-41b8-5b0a-a604-c63fbf1dc578",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-context",
      "purl": "pkg:maven/org.springframework/spring-context@6.0.15-tuxcare.6",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-context@6.0.15-tuxcare.6",
      "version": "6.0.15-tuxcare.6",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-context",
            "purl": "pkg:maven/org.springframework/spring-context@6.0.15",
            "type": "library",
            "group": "org.springframework",
            "version": "6.0.15"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2022-22968",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@6.0.15-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:4c2dca37-9bcd-515f-a170-14409c2ac254",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22968 does not affect version 6.0.15-tuxcare.6 of org.springframework:spring-context. not_affected \u2014 CVE-2022-22968 is NOT present in Spring Framework 6.0.15. The vulnerability (case-sensitive disallowedFields pattern matching allowing bypass via case variations) was fixed upstream by Sam Brannen in commit a7cf19cec5ebd270f97a194d749e2d5701ad2ab7 on April 3, 2022. This fix was included in Spring Framework 5.3.19 and 5.2.21, and subsequently in all 6.0.x releases. The target version 6.0.15 was ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-38820",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@6.0.15-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:c2545b48-37ea-5fae-93f4-e1a8d1b1dee3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-38820 affects version 6.0.15-tuxcare.6 of org.springframework:spring-context, and is fixed in 6.0.15-tuxcare.7."
      }
    },
    {
      "id": "CVE-2025-22233",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@6.0.15-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:13e4b263-32ae-52e3-9cb0-44ef3c6f5822",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-22233 affects version 6.0.15-tuxcare.6 of org.springframework:spring-context, and is fixed in 6.0.15-tuxcare.8."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-context@6.0.15-tuxcare.6"
    }
  ]
}