{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:92154978-09f1-5171-b385-525e5f262023",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring",
      "purl": "pkg:maven/org.springframework/spring@5.3.25-tuxcare.11",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring@5.3.25-tuxcare.11",
      "version": "5.3.25-tuxcare.11",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring",
            "purl": "pkg:maven/org.springframework/spring@5.3.25",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.25"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2010-1622",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.25-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:5e63520e-de7b-567b-a672-ad99f8367dbf",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2010-1622 does not affect version 5.3.25-tuxcare.11 of org.springframework:spring. not_affected \u2014 Spring Framework 5.3.25-tuxcare.11 is NOT AFFECTED by CVE-2010-1622. The vulnerability was fixed by upstream Spring Framework in May 2010 (commit 3a5af35d37 by Juergen Hoeller from VMware/Spring team). This fix was already present in version 5.3.25 when TuxCare onboarded it. The target code contains comprehensive defenses that prevent binding to the classLoader property: (1) a whitelist approac...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-22096",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.25-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:3b6f24d3-2818-50fb-99a9-c1b2dc19a3e5",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-22096 does not affect version 5.3.25-tuxcare.11 of org.springframework:spring. not_affected \u2014 CVE-2021-22096 (log injection via malicious input containing newlines/control characters) is NOT present in Spring Framework 5.3.25-tuxcare.11. The upstream vendor (VMware/Spring) fixed this vulnerability in commits 99c7608ffe and e9083d7d by adding newline and control character sanitization to LogFormatUtils and applying it across logging call sites. Both fix commits were already included in t...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-20860",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.25-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:dee7ea9c-b7f8-5356-ba49-2ec1f427b5c2",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-20860 is fixed in version 5.3.25-tuxcare.11 of org.springframework:spring."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring@5.3.25-tuxcare.11"
    }
  ]
}