{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:09e169dc-9e75-5e67-90f5-f3ed7be3d774",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-context",
      "purl": "pkg:maven/org.springframework/spring-context@6.1.15-tuxcare.6",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-context@6.1.15-tuxcare.6",
      "version": "6.1.15-tuxcare.6",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-context",
            "purl": "pkg:maven/org.springframework/spring-context@6.1.15",
            "type": "library",
            "group": "org.springframework",
            "version": "6.1.15"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2022-22968",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@6.1.15-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:11aa51fa-fa00-51a1-8cfc-23eb2459178c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22968 does not affect version 6.1.15-tuxcare.6 of org.springframework:spring-context. not_affected \u2014 CVE-2022-22968 affects Spring Framework versions 5.3.0-5.3.18 and 5.2.0-5.2.20 where disallowedFields patterns in DataBinder were case-sensitive, allowing attackers to bypass field restrictions by varying case (e.g., \"Id\" vs \"id\"). The target version 6.1.15 is not affected because the upstream vendor fix (commit a7cf19cec5) was already included in the upstream release. The fix makes disallowedF...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-38820",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@6.1.15-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:fa6a5862-05eb-56ee-9d5e-5d9539c9fd6e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-38820 does not affect version 6.1.15-tuxcare.6 of org.springframework:spring-context. not_affected \u2014 Spring Framework 6.1.15 upstream release already contained the fix for CVE-2024-38820 (commit 23656aebc6 by Rossen Stoyanchev, using Locale.ROOT for case conversion). TuxCare onboarded this already-fixed version. The vulnerable pattern (String.toLowerCase() without explicit Locale, causing Turkish-I and similar locale-dependent mismatches in disallowed field protection) was never present in the...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-22233",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@6.1.15-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:cb410e23-d692-58e5-8310-7ccc62c5b4f7",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-context."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-context@6.1.15-tuxcare.6"
    }
  ]
}