{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:efafd962-23bb-548c-b7e1-a9c9fc058813",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-context",
      "purl": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.14",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.14",
      "version": "6.1.21-tuxcare.14",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-context",
            "purl": "pkg:maven/org.springframework/spring-context@6.1.21",
            "type": "library",
            "group": "org.springframework",
            "version": "6.1.21"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2022-22968",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.14"
        }
      ],
      "bom-ref": "urn:uuid:3da5792b-17d8-5c4f-ab34-5a082b5715ac",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22968 does not affect version 6.1.21-tuxcare.14 of org.springframework:spring-context. not_affected \u2014 CVE-2022-22968 is not present in Spring Framework 6.1.21-tuxcare.16. The vulnerability (case-sensitive matching of disallowedFields patterns in DataBinder, allowing attackers to bypass field protections using case variations like \"Id\" instead of \"id\") was fixed in upstream Spring Framework before version 6.1.21 was released. The target contains the fix using PatternMatchUtils.simpleMatchIgnoreC...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-38820",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.14"
        }
      ],
      "bom-ref": "urn:uuid:3d6be6e7-3580-5067-9d8d-f179bf68a80b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-38820 does not affect version 6.1.21-tuxcare.14 of org.springframework:spring-context. not_affected \u2014 CVE-2024-38820 (locale-dependent toLowerCase bypassing disallowedFields) is NOT present in Spring Framework 6.1.21. The upstream vendor fixed the vulnerability in commit 23656aebc6 (Oct 2024) by using toLowerCase(Locale.ROOT), then refactored to simpleMatchIgnoreCase in commit edfcc6ffb1 (May 2025). Both commits shipped in the upstream 6.1.21 release. The refactored code uses equalsIgnoreCase()...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-22233",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.14"
        }
      ],
      "bom-ref": "urn:uuid:5ba41afb-c469-58e8-882a-c745f246d723",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-22233 does not affect version 6.1.21-tuxcare.14 of org.springframework:spring-context. Version 6.1.21 is not affected by CVE-2025-22233: the security fix is already present in the target branch. Momus prerequisite check: \"Patches already applied: ee62701f5634e904e42e218baad142cea2bcd332\". No backport needed."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.14"
    }
  ]
}