{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:c02d8060-8a82-5511-8b06-4fdc41c438a0",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-context",
      "purl": "pkg:maven/org.springframework/spring-context@6.2.3-tuxcare.2",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-context@6.2.3-tuxcare.2",
      "version": "6.2.3-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-context",
            "purl": "pkg:maven/org.springframework/spring-context@6.2.3",
            "type": "library",
            "group": "org.springframework",
            "version": "6.2.3"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2022-22968",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:606138d4-dcd3-5a01-9dd1-bf761f7a45cc",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22968 does not affect version 6.2.3-tuxcare.2 of org.springframework:spring-context. not_affected \u2014 CVE-2022-22968 fix was already present in upstream Spring Framework 6.2.3 when TuxCare onboarded it. The vulnerability allowed bypassing DataBinder disallowedFields restrictions via case variation (e.g., \"password\" vs \"Password\"). The fix implements case-insensitive pattern matching in DataBinder.isAllowed(). Upstream commit a7cf19cec5 by Sam Brannen (sbrannen@vmware.com) on 2022-04-03 added lo...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-38820",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:435b506c-9082-56b0-bb58-48745a5ee4c8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-38820 does not affect version 6.2.3-tuxcare.2 of org.springframework:spring-context. not_affected \u2014 The target Spring Framework 6.2.3 is NOT affected by CVE-2024-38820. The vulnerability involves locale-dependent String.toLowerCase() in DataBinder's disallowedFields protection, which could allow attackers to bypass field access restrictions using locale-sensitive characters (e.g., Turkish 'I' \u2192 '\u0131'). The fix (using Locale.ROOT for consistent case conversion) was authored by the upstream Sprin...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-22233",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ac4f5883-1ca2-584f-a2e2-e5b45f805982",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-22233 affects version 6.2.3-tuxcare.2 of org.springframework:spring-context, and is fixed in 6.2.3-tuxcare.4."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-context@6.2.3-tuxcare.2"
    }
  ]
}