{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:f70de485-6b42-5073-9c17-093634867e77",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-context",
      "purl": "pkg:maven/org.springframework/spring-context@6.2.7-tuxcare.2",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-context@6.2.7-tuxcare.2",
      "version": "6.2.7-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-context",
            "purl": "pkg:maven/org.springframework/spring-context@6.2.7",
            "type": "library",
            "group": "org.springframework",
            "version": "6.2.7"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2022-22968",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@6.2.7-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:38f91a8f-bf7c-5dc6-9862-551530bc554f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22968 does not affect version 6.2.7-tuxcare.2 of org.springframework:spring-context. not_affected \u2014 CVE-2022-22968 is not present in Spring Framework 6.2.7. The target uses PatternMatchUtils.simpleMatchIgnoreCase() for case-insensitive matching of disallowed fields, providing equivalent protection to the patch's toLowerCase() approach. The fix was already present in the upstream Spring Framework 6.2.7 release (onboarded in commit 3c5280fed6), as this version was released well after the CVE wa...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-38820",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@6.2.7-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a47e9320-2997-52f7-a9e3-11a400ce6ccd",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-38820 does not affect version 6.2.7-tuxcare.2 of org.springframework:spring-context. not_affected \u2014 The target Spring Framework 6.2.7 is NOT vulnerable to CVE-2024-38820. The upstream release shipped with a refactored fix that uses PatternMatchUtils.simpleMatchIgnoreCase() for case-insensitive pattern matching in DataBinder.isAllowed(), which employs locale-independent Unicode case folding via String.equalsIgnoreCase() and String.regionMatches(ignoreCase=true). The vulnerable pattern (using S...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-22233",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-context@6.2.7-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:d5a718a6-3225-5bdc-bda3-ec6f33f576e9",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-22233 does not affect version 6.2.7-tuxcare.2 of org.springframework:spring-context. not_affected \u2014 CVE-2025-22233 is NOT present in Spring Framework 6.2.7. The vulnerability involved bypassing disallowedFields checks through case variation attacks on wildcard patterns. The upstream Spring Framework fixed this in two commits (5c5cf73e11 adding simpleMatchIgnoreCase methods, ee62701f56 using them in DataBinder) both authored by rossen.stoyanchev@broadcom.com and shipped in the 6.2.7 release. T...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-context@6.2.7-tuxcare.2"
    }
  ]
}