{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:0cdc0efe-ee67-54ca-b583-f2d886a5ea06",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "protobuf-kotlin",
      "purl": "pkg:maven/com.google.protobuf/protobuf-kotlin@3.21.12-tuxcare.1",
      "type": "library",
      "group": "com.google.protobuf",
      "bom-ref": "pkg:maven/com.google.protobuf/protobuf-kotlin@3.21.12-tuxcare.1",
      "version": "3.21.12-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "protobuf-kotlin",
            "purl": "pkg:maven/com.google.protobuf/protobuf-kotlin@3.21.12",
            "type": "library",
            "group": "com.google.protobuf",
            "version": "3.21.12"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2021-22569",
      "affects": [
        {
          "ref": "pkg:maven/com.google.protobuf/protobuf-kotlin@3.21.12-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:05d2c20f-7827-5fee-8dc5-4e84e68671f3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-22569 does not affect version 3.21.12-tuxcare.1 of com.google.protobuf:protobuf-kotlin. CVE-2021-22569 is not present in protobuf 3.21.12. The vulnerability was a DoS issue in UnknownFieldSet parsing that created excessive short-lived objects causing GC pauses. The fix (commit c555c3dd1) refactored UnknownFieldSet.Builder to use TreeMap<Integer, Field.Builder> instead of the lastField/lastFieldNumber optimization, eliminating repeated Field object creation. This fix was authored by Google's protobuf team (acozzette@google.com) and shipped in upstream protobuf 3.21.12, which TuxCare onboarded. The target code at java/core/src/main/java/com/google/protobuf/UnknownFieldSet.java:308 contains the fixed implementation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.16.1; >= 3.18.0, < 3.18.2; >= 3.19.0, < 3.19.2; >= 3.18.0, < 3.18.2; >= 3.19.0, < 3.19.2), NVD (< 3.19.2; < 3.16.1; >= 3.18.0, < 3.18.2; >= 3.19.0, < 3.19.2; < 3.18.2; >= 3.19.0, < 3.19.2), cve.org (< 3.16.1; < 3.18.2; < 3.19.2; < 3.18.2; < 3.19.2; < 3.19.2), Snyk (< 3.16.1; >= 3.17.0, < 3.18.2; >= 3.19.0, < 3.19.2; < 3.18.2; >= 3.19.0, < 3.19.2).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-3171",
      "affects": [
        {
          "ref": "pkg:maven/com.google.protobuf/protobuf-kotlin@3.21.12-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9958f764-06b0-52bb-b321-acb1cb74157e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-3171 does not affect version 3.21.12-tuxcare.1 of com.google.protobuf:protobuf-kotlin. not_affected \u2014 CVE-2022-3171 is NOT present in protobuf 3.21.12. The vulnerability was fixed in upstream protobuf 3.21.7 (commit 3b5301c114 \"Refactoring Java parsing\"), which refactored the parsing logic to merge directly into mutable message objects instead of repeatedly creating and converting between mutable and immutable forms. Since the target is version 3.21.12 (onboarded from upstream after 3.21.7), it...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-7254",
      "affects": [
        {
          "ref": "pkg:maven/com.google.protobuf/protobuf-kotlin@3.21.12-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0e6dd173-3112-5101-ab81-603e1d6a1732",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-7254 is fixed in version 3.21.12-tuxcare.1 of com.google.protobuf:protobuf-kotlin."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/com.google.protobuf/protobuf-kotlin@3.21.12-tuxcare.1"
    }
  ]
}