{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:658b5dd7-ee1d-591f-824f-2f23b530172f",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "logback-classic",
      "purl": "pkg:maven/ch.qos.logback/logback-classic@1.2.3-tuxcare.2",
      "type": "library",
      "group": "ch.qos.logback",
      "bom-ref": "pkg:maven/ch.qos.logback/logback-classic@1.2.3-tuxcare.2",
      "version": "1.2.3-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "logback-classic",
            "purl": "pkg:maven/ch.qos.logback/logback-classic@1.2.3",
            "type": "library",
            "group": "ch.qos.logback",
            "version": "1.2.3"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2017-5929",
      "affects": [
        {
          "ref": "pkg:maven/ch.qos.logback/logback-classic@1.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:bec1afa1-5846-59c3-aea3-f74ab36bf048",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-5929 does not affect version 1.2.3-tuxcare.2 of ch.qos.logback:logback-classic. CVE-2017-5929 affects Logback versions before 1.2.0. The target version 1.2.3 already includes the upstream fix (HardenedObjectInputStream with whitelist validation) that was introduced by upstream maintainer Ceki Gulcu in commit f46044b8. The fix was shipped in the upstream release 1.2.3 that TuxCare onboarded. All socket deserialization entry points (SocketNode, RemoteAppenderStreamClient, SocketReceiver) use the hardened streams with class name whitelist validation in resolveClass(), preventing arbitrary class instantiation during deserialization. No raw ObjectInputStream usage found in production code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.2.0; < 1.2.0), NVD (< 1.2.0), Snyk (>= 0.3, < 1.2.0; >= 0.6, < 1.2.0; < 1.1.11).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-6378",
      "affects": [
        {
          "ref": "pkg:maven/ch.qos.logback/logback-classic@1.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:4766dd19-bc83-5273-a59e-32120d659288",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-6378 affects version 1.2.3-tuxcare.2 of ch.qos.logback:logback-classic."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/ch.qos.logback/logback-classic@1.2.3-tuxcare.2"
    }
  ]
}