{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:d9bf5e74-49c7-5475-8181-cd0907a84594",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring",
      "purl": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13",
      "version": "5.3.37-tuxcare.13",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring",
            "purl": "pkg:maven/org.springframework/spring@5.3.37",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.37"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2010-1622",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:8bdafa4e-0ff8-5b88-b94e-9ff9f063bfce",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2010-1622 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring. not_affected \u2014 CVE-2010-1622 is NOT present in Spring Framework 5.3.37-tuxcare.13. The vulnerability allowed remote code execution via HTTP request parameters targeting `class.classLoader.URLs[0]` to load malicious JAR files. The upstream fix (commit 3a5af35d37c by Juergen Hoeller, 2010-05-27) was already present in the Spring Framework 5.3.37 release that TuxCare onboarded. The target contains multiple defen...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-22096",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:67f0fa8c-1e0b-55f8-941d-d966728b3a65",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-22096 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring. not_affected \u2014 The target Spring Framework 5.3.37 is NOT AFFECTED by CVE-2021-22096 (log injection vulnerability). The vulnerability pattern - unfiltered user-controlled input in log statements - is not present in the target because it was removed by upstream Spring Framework fixes (commits 99c7608f and e9083d7d) that shipped with the upstream 5.3.37 release. These upstream commits added LogFormatUtils saniti...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-20860",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:7d8af70b-115f-5960-8d61-bfb29bd12ce0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-20860 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring. CVE-2023-20860 affects Spring Framework 5.3.0-5.3.25 and 6.0.0-6.0.6. The target version 5.3.37 is NOT affected because the fix was already included in the upstream Spring Framework 5.3.37 release. The vulnerability involved a pattern matching mismatch where \"**\" patterns in Spring Security mvcRequestMatcher didn't properly match paths, allowing security bypass. The fix (commit 1cd994d3a88 by upstream developer rstoyanchev@vmware.com on 2023-07-11) adds pattern normalization by prepending \"/\" to non-empty patterns that don't start with \"/\". This fix was released in Spring Framework 5.3.26+ and is present in the target's 5.3.37 base.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.0.0, < 6.0.7; >= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7; >= 5.3.0, < 5.3.26), NVD (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7), cve.org (>= 6.0.0, <= 6.0.6; >= 5.3.0, <= 5.3.25), Snyk (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring@5.3.37-tuxcare.13"
    }
  ]
}