{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:ae3f4269-a196-59f7-828b-22cb515c4cd6",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-framework-bom",
      "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.20-tuxcare.3",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.20-tuxcare.3",
      "version": "5.3.20-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-framework-bom",
            "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.20",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.20"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2020-5421",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.20-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:7c8148ce-6db5-542a-a699-aa3420352541",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-5421 does not affect version 5.3.20-tuxcare.3 of org.springframework:spring-framework-bom. not_affected \u2014 CVE-2020-5421 (RFD attack bypass via jsessionid path parameter) is NOT AFFECTED in Spring Framework 5.3.20. The upstream vendor fix was already present in the 5.3.20 release when TuxCare onboarded it. The fix includes: (1) UrlPathHelper.removeJsessionid() method that strips `;jsessionid=<value>` from request URIs even when general semicolon removal is disabled, (2) WebUtils.parseMatrixVariables...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-framework-bom@5.3.20-tuxcare.3"
    }
  ]
}