{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:e3fc2fab-0f6d-50f9-bec2-ade52b32379e",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-context",
      "purl": "pkg:maven/org.springframework/spring-context@6.1.19-tuxcare.5",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-context@6.1.19-tuxcare.5",
      "version": "6.1.19-tuxcare.5",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-context",
            "purl": "pkg:maven/org.springframework/spring-context@6.1.19",
            "type": "library",
            "group": "org.springframework",
            "version": "6.1.19"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2022-22968",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@6.1.19-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:27371696-c8c8-56c1-bf15-a3c6b1129962",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22968 does not affect version 6.1.19-tuxcare.5 of org.springframework:spring-context. not_affected \u2014 Target version 6.1.19 is not affected by CVE-2022-22968. The vulnerability (case-sensitive disallowed field pattern matching in DataBinder allowing attackers to bypass protection by varying field name case) was fixed in the upstream Spring Framework 6.x branch before this version was released. The fix makes disallowed field matching case-insensitive by using PatternMatchUtils.simpleMatchIgnoreC...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-38820",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@6.1.19-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:d07d0448-0107-512c-9a20-b34c64bbfa14",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-38820 does not affect version 6.1.19-tuxcare.5 of org.springframework:spring-context. The upstream fix was released in 6.1.14, and version 6.1.19 is a later release of the same line. Advisories: GitHub GHSA-4gc7-5j7h-4qph (fixed in 6.1.14), NVD (fixed in 6.1.14), CVE record (fixed in 6.1.14), Snyk (fixed in 6.1.14).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-22233",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@6.1.19-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:b8cb30ea-418f-597b-9e41-732dba688fbc",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.1.19-tuxcare.5 of org.springframework:spring-context."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-context@6.1.19-tuxcare.5"
    }
  ]
}