{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:c991ad38-cc74-51a4-b8fb-656ef24b7d26",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-framework-bom",
      "purl": "pkg:maven/org.springframework/spring-framework-bom@4.1.9.RELEASE-tuxcare.2",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-framework-bom@4.1.9.RELEASE-tuxcare.2",
      "version": "4.1.9.RELEASE-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-framework-bom",
            "purl": "pkg:maven/org.springframework/spring-framework-bom@4.1.9.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "4.1.9.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2020-5421",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-framework-bom@4.1.9.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:6a225529-6559-52cf-a515-ca7af4f045ad",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-5421 does not affect version 4.1.9.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom. already_fixed \u2014 The target repository (Spring Framework 4.1.9.RELEASE) already contains the essential fix for CVE-2020-5421. The UrlPathHelper.removeSemicolonContent() method ensures jsessionid path parameters are always stripped from request URIs, even when removeSemicolonContent is set to false. This prevents attackers from using jsessionid path parameters to bypass RFD (Reflected File Download) attack prote...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-framework-bom@4.1.9.RELEASE-tuxcare.2"
    }
  ]
}