{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:0755651b-7393-529a-85eb-65300a61eada",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-crypto",
      "purl": "pkg:maven/org.springframework.security/spring-security-crypto@5.8.16-tuxcare.15",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-crypto@5.8.16-tuxcare.15",
      "version": "5.8.16-tuxcare.15",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-crypto",
            "purl": "pkg:maven/org.springframework.security/spring-security-crypto@5.8.16",
            "type": "library",
            "group": "org.springframework.security",
            "version": "5.8.16"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2007-1651",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-crypto@5.8.16-tuxcare.15"
        }
      ],
      "bom-ref": "urn:uuid:98224cda-64af-5ba3-8139-4566e7d686a1",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2007-1651 is a false positive for org.springframework.security:spring-security-crypto 5.8.16-tuxcare.15. direct vulnerability is in OpenID project"
      }
    },
    {
      "id": "CVE-2007-1652",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-crypto@5.8.16-tuxcare.15"
        }
      ],
      "bom-ref": "urn:uuid:c475f536-775f-5eb0-a195-d91e2b242d3d",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2007-1652 is a false positive for org.springframework.security:spring-security-crypto 5.8.16-tuxcare.15. CVE-2007-1652 is a vulnerability in JanRain's myOpenID service, on the OpenID Provider side. The CVE record carries vendor and product \\\"n/a\\\" and a single version-unbounded CPE, cpe:2.3:a:openid:openid:*, and every reference points to JanRain's myOpenID security announcement of March 2007 and the openid.net security mailing list threads of the same month. The reported mechanism - a crafted web page that forcibly logs a user into an OpenID-enabled site, releases the user's personal information to it, and silently adds it to the user's trusted-sites list by way of a cached authentication token - consists entirely of decisions taken by an OpenID Provider. A relying party has no trusted-sites list and no auto-approval step at which the flaw could occur. The openid module of this library implements only the relying-party (consumer) role: OpenIDAuthenticationFilter drives the two-leg consumer flow and OpenID4JavaConsumer wraps openid4java's ConsumerManager. The tree contains no OpenID Provider implementation - no use of openid4java's server package or ServerManager - and no trusted-sites or auto-approval handling anywhere. Nor could this library have been affected when the issue was disclosed: the CVE was published on 24 March 2007, while the earliest OpenID code in the project dates from 20 April 2007 and only reached the shipped openid module in January 2008. The vulnerability therefore does not apply to this library in any version."
      }
    },
    {
      "id": "CVE-2025-22228",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-crypto@5.8.16-tuxcare.15"
        }
      ],
      "bom-ref": "urn:uuid:c8eb76c0-9e0a-5b3f-a2cc-f2260b05f89d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-22228 is fixed in version 5.8.16-tuxcare.15 of org.springframework.security:spring-security-crypto."
      }
    },
    {
      "id": "CVE-2025-22234",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-crypto@5.8.16-tuxcare.15"
        }
      ],
      "bom-ref": "urn:uuid:ab335894-e7c2-543f-98b9-78f39faf2b5e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-22234 is fixed in version 5.8.16-tuxcare.15 of org.springframework.security:spring-security-crypto."
      }
    },
    {
      "id": "CVE-2026-47842",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-crypto@5.8.16-tuxcare.15"
        }
      ],
      "bom-ref": "urn:uuid:4891028d-5667-5212-a9ff-6afac0eb282e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-47842 affects version 5.8.16-tuxcare.15 of org.springframework.security:spring-security-crypto, and is fixed in 5.8.16-tuxcare.16."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-crypto@5.8.16-tuxcare.15"
    }
  ]
}