{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:0ca099c2-2d86-5518-ae7d-4359486ab727",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring",
      "purl": "pkg:maven/org.springframework/spring@5.2.25.RELEASE-tuxcare.2",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring@5.2.25.RELEASE-tuxcare.2",
      "version": "5.2.25.RELEASE-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring",
            "purl": "pkg:maven/org.springframework/spring@5.2.25.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "5.2.25.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2010-1622",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.2.25.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:aa740f2a-5df4-545b-b01e-afcee656fb45",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2010-1622 affects version 5.2.25.RELEASE-tuxcare.2 of org.springframework:spring."
      }
    },
    {
      "id": "CVE-2021-22096",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.2.25.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:0b25b412-7c9f-586b-8a8d-2e836f053c72",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-22096 does not affect version 5.2.25.RELEASE-tuxcare.2 of org.springframework:spring. not_affected \u2014 The target Spring Framework 5.2.25.RELEASE is NOT vulnerable to CVE-2021-22096 (log injection). The vulnerability pattern is not present because the upstream vendor fix was already included when 5.2.25.RELEASE was released. The fix sanitizes newlines and control characters in logged values through LogFormatUtils.formatValue(), preventing attackers from injecting fabricated log entries. Fix comm...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-20860",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring@5.2.25.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:f99048a1-069d-5ce2-b717-d15e8cda2810",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-20860 affects version 5.2.25.RELEASE-tuxcare.2 of org.springframework:spring."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring@5.2.25.RELEASE-tuxcare.2"
    }
  ]
}