{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:358a3df4-5a19-5d97-b396-18c6030a6c29",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring",
      "purl": "pkg:maven/org.springframework/spring@5.3.13-tuxcare.3",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring@5.3.13-tuxcare.3",
      "version": "5.3.13-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring",
            "purl": "pkg:maven/org.springframework/spring@5.3.13",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.13"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2010-1622",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.13-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:297aa6c8-72a7-5bcd-a3e1-66d23ce32b18",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2010-1622 does not affect version 5.3.13-tuxcare.3 of org.springframework:spring. not_affected \u2014 CVE-2010-1622 is NOT present in Spring Framework 5.3.13-tuxcare.4. The vulnerability allowed remote code execution by binding HTTP request parameters to Class.classLoader properties. The upstream fix (commit 3a5af35d37 by jhoeller@vmware.com) was already included in the Spring Framework 5.3.13 release that TuxCare onboarded. The fix filters out ClassLoader and ProtectionDomain property types du...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-22096",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.13-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:be99e657-0bf5-580a-a2e5-01a71d2fb096",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-22096 does not affect version 5.3.13-tuxcare.3 of org.springframework:spring. not_affected \u2014 The target Spring Framework 5.3.13 is not affected by CVE-2021-22096 (log injection vulnerability). The CVE affects versions 5.3.0-5.3.10, and version 5.3.13 includes the upstream vendor fix (commit 05ea991d62) that removed vulnerable resource location logging. The fix was shipped in the upstream 5.3.13 release (Nov 11, 2021) before any TuxCare modifications. Additional sanitization via LogForm...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-20860",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.13-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:b0d92720-ea49-5b17-afc9-4b55ae060164",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-20860 is fixed in version 5.3.13-tuxcare.3 of org.springframework:spring."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring@5.3.13-tuxcare.3"
    }
  ]
}