{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:67c00819-b18f-55f5-b002-59001f7dead8",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-context",
      "purl": "pkg:maven/org.springframework/spring-context@6.2.1-tuxcare.6",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-context@6.2.1-tuxcare.6",
      "version": "6.2.1-tuxcare.6",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-context",
            "purl": "pkg:maven/org.springframework/spring-context@6.2.1",
            "type": "library",
            "group": "org.springframework",
            "version": "6.2.1"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2022-22968",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@6.2.1-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:e05be04a-a3fe-5fc6-9a67-85238d9266bb",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22968 does not affect version 6.2.1-tuxcare.6 of org.springframework:spring-context. not_affected \u2014 Spring Framework 6.2.1-tuxcare.6 is not affected by CVE-2022-22968. The vulnerability (case-sensitive disallowed field matching allowing attackers to bypass security restrictions by varying field name case) was fixed in the upstream Spring Framework release prior to v6.2.1. Commit a7cf19cec5 by Sam Brannen (April 2022) introduced case-insensitive matching for disallowed fields. This fix shipped...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-38820",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@6.2.1-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:9f885a07-f886-53d2-8eed-4a44030a3732",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-38820 does not affect version 6.2.1-tuxcare.6 of org.springframework:spring-context. Version 6.2.1 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-4gc7-5j7h-4qph (affected below 6.1.14), NVD (affected below 6.1.14), CVE record (affected below 6.1.14), Snyk (affected below 6.1.14).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-22233",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@6.2.1-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:a939dd51-22d7-5df3-a99a-2eb7eaea7558",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.2.1-tuxcare.6 of org.springframework:spring-context."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-context@6.2.1-tuxcare.6"
    }
  ]
}