{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:55e2868b-ffdb-5db8-bbf9-686834c78e02",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring",
      "purl": "pkg:maven/org.springframework/spring@5.3.15-tuxcare.3",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring@5.3.15-tuxcare.3",
      "version": "5.3.15-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring",
            "purl": "pkg:maven/org.springframework/spring@5.3.15",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.15"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2010-1622",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.15-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:387d5056-87b2-5035-a36b-db5d926cd527",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2010-1622 does not affect version 5.3.15-tuxcare.3 of org.springframework:spring. not_affected \u2014 CVE-2010-1622 is NOT present in Spring Framework 5.3.15. The vulnerability allowed remote code execution via HTTP parameters like `class.classLoader.URLs[0]=jar:...` that bound to sensitive ClassLoader properties. The target contains comprehensive defenses in CachedIntrospectionResults.java that filter classLoader properties through two mechanisms: (1) a restrictive whitelist for Class.class al...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-22096",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.15-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:c2633e9d-7330-5224-9854-e0b0e12aa1f4",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-22096 does not affect version 5.3.15-tuxcare.3 of org.springframework:spring. not_affected \u2014 CVE-2021-22096 (log injection via newline/control characters) does NOT affect Spring Framework 5.3.15. The vulnerability was fixed by upstream Spring in version 5.3.14 (commit 99c7608f, Dec 2021) before the 5.3.15 release. The fix added control character sanitization to LogFormatUtils and applied it throughout the codebase where user-controlled input is logged. The CVE explicitly lists only ver...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-20860",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.15-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:f91fb980-c165-5c8f-a6c9-e8020ae1d83a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-20860 affects version 5.3.15-tuxcare.3 of org.springframework:spring, and is fixed in 5.3.15-tuxcare.4."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring@5.3.15-tuxcare.3"
    }
  ]
}