{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:03b7ffc7-5623-581a-b01a-7a5ea5c7949e",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring",
      "purl": "pkg:maven/org.springframework/spring@5.3.32-tuxcare.3",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring@5.3.32-tuxcare.3",
      "version": "5.3.32-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring",
            "purl": "pkg:maven/org.springframework/spring@5.3.32",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.32"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2010-1622",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.32-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:f6a0fe80-35a2-50c0-8add-387ddbf296e4",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2010-1622 does not affect version 5.3.32-tuxcare.3 of org.springframework:spring. not_affected \u2014 Spring Framework 5.3.32 is not affected by CVE-2010-1622. The vulnerability allowed remote code execution via HTTP parameters binding to `class.classLoader.URLs[0]`. Upstream Spring added comprehensive protections in March 2022 (commit 002546b3) that block ALL Class property access except name variants, plus explicitly filter ClassLoader and ProtectionDomain types. These defenses were already p...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-22096",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.32-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:87475f3b-7589-56f3-8036-c9d77489e86e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-22096 does not affect version 5.3.32-tuxcare.3 of org.springframework:spring. not_affected \u2014 CVE-2021-22096 (log injection via newlines/control characters) is NOT present in Spring Framework 5.3.32-tuxcare.3. The vulnerability allowed attackers to inject additional log entries by embedding newlines and control characters in user-controlled input that was logged without sanitization. The upstream Spring Framework fix was already included in the 5.3.32 release (shipped in v5.3.14+ from D...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-20860",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.32-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:aaaebfe0-5381-581d-a9d4-700442265085",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-20860 does not affect version 5.3.32-tuxcare.3 of org.springframework:spring. CVE-2023-20860: Spring Framework 5.3.32 is NOT AFFECTED. The vulnerability pattern (pattern matching mismatch between Spring Security and Spring MVC when using \"**\" patterns) is not present because the target contains the upstream vendor fix. The fix normalizes security patterns by prepending \"/\" to non-empty patterns lacking a leading slash, ensuring consistent interpretation between Spring Security's mvcRequestMatcher and Spring MVC's handler matching. This fix was included in Spring Framework 5.3.29 (released upstream in July 2023) via commit 1cd994d3a886 by rstoyanchev@vmware.com, which predates the TuxCare onboarding of version 5.3.32.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.0.0, < 6.0.7; >= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7; >= 5.3.0, < 5.3.26), NVD (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7), cve.org (>= 6.0.0, <= 6.0.6; >= 5.3.0, <= 5.3.25), Snyk (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring@5.3.32-tuxcare.3"
    }
  ]
}