{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:d6872233-528e-58e5-bfa4-4d3e736f07c7",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring",
      "purl": "pkg:maven/org.springframework/spring@5.3.24-tuxcare.10",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring@5.3.24-tuxcare.10",
      "version": "5.3.24-tuxcare.10",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring",
            "purl": "pkg:maven/org.springframework/spring@5.3.24",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.24"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2010-1622",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.24-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:33b23987-6cf1-5a71-99e1-8980600d3c00",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2010-1622 does not affect version 5.3.24-tuxcare.10 of org.springframework:spring. not_affected \u2014 CVE-2010-1622 is not present in Spring Framework 5.3.24-tuxcare.10. The vulnerability allowed remote code execution via property binding to `class.classLoader.URLs[0]`. The upstream fix (commit 002546b3e4, March 2022) was included in the Spring Framework 5.3.24 release before TuxCare onboarding. The fix implements multiple defenses: a whitelist approach for Class properties (only \"name\" variant...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-22096",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.24-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:26cd6ebc-6049-518b-aed1-67101aac9f9f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-22096 does not affect version 5.3.24-tuxcare.10 of org.springframework:spring. not_affected \u2014 CVE-2021-22096 (log injection via newline characters) is NOT present in Spring Framework 5.3.24-tuxcare.10. The upstream fix (commit 99c7608ffe by Rossen Stoyanchev) shipped in Spring Framework 5.3.24 before TuxCare onboarded this version. The fix adds sanitization in LogFormatUtils.formatValue() that replaces newline characters (\\n, \\r) with <EOL> and control characters with ? before logging. ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-20860",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.24-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:c419591a-6968-54f1-a4b4-dcc3d07b5b88",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-20860 is fixed in version 5.3.24-tuxcare.10 of org.springframework:spring."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring@5.3.24-tuxcare.10"
    }
  ]
}