{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:64b47d00-cbe1-5caa-b6b1-5533e5af7a16",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "protobuf-kotlin",
      "purl": "pkg:maven/com.google.protobuf/protobuf-kotlin@3.21.7-tuxcare.2",
      "type": "library",
      "group": "com.google.protobuf",
      "bom-ref": "pkg:maven/com.google.protobuf/protobuf-kotlin@3.21.7-tuxcare.2",
      "version": "3.21.7-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "protobuf-kotlin",
            "purl": "pkg:maven/com.google.protobuf/protobuf-kotlin@3.21.7",
            "type": "library",
            "group": "com.google.protobuf",
            "version": "3.21.7"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2021-22569",
      "affects": [
        {
          "ref": "pkg:maven/com.google.protobuf/protobuf-kotlin@3.21.7-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:f7b1b681-b308-5803-b357-e2c6ec998d8c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-22569 does not affect version 3.21.7-tuxcare.2 of com.google.protobuf:protobuf-kotlin. CVE-2021-22569 affects protobuf-java versions prior to 3.16.1, 3.18.2, and 3.19.2 through a performance DoS in unknown field parsing. The target repository is protobuf version 3.21.7, which is newer than all fixed versions. Analysis confirms the fix (TreeMap-based persistent field builders replacing the vulnerable last-field-caching pattern) is present and was shipped in the upstream 3.21.7 release via commit 9638a5e5315bf73f5e7148c16181676372321892 by Google engineer Adam Cozzette, prior to TuxCare's onboarding of this version. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.16.1; >= 3.18.0, < 3.18.2; >= 3.19.0, < 3.19.2; >= 3.18.0, < 3.18.2; >= 3.19.0, < 3.19.2), NVD (< 3.19.2; < 3.16.1; >= 3.18.0, < 3.18.2; >= 3.19.0, < 3.19.2; < 3.18.2; >= 3.19.0, < 3.19.2), cve.org (< 3.16.1; < 3.18.2; < 3.19.2; < 3.18.2; < 3.19.2; < 3.19.2), Snyk (< 3.16.1; >= 3.17.0, < 3.18.2; >= 3.19.0, < 3.19.2; < 3.18.2; >= 3.19.0, < 3.19.2).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-3171",
      "affects": [
        {
          "ref": "pkg:maven/com.google.protobuf/protobuf-kotlin@3.21.7-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:cff9dc12-a234-53e9-9092-20f6789a2817",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-3171 does not affect version 3.21.7-tuxcare.2 of com.google.protobuf:protobuf-kotlin. not_affected \u2014 CVE-2022-3171 DoS vulnerability pattern is NOT present in target protobuf-java 3.21.7-tuxcare.2. The vulnerable parsing pattern (repeatedly creating new immutable message instances and merging them, causing allocation amplification and GC pauses) was removed by upstream vendor fix commit 3b5301c11 dated 2022-09-28, which shipped in protobuf 3.21.7 release. The fix refactored Java parsing to reu...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-7254",
      "affects": [
        {
          "ref": "pkg:maven/com.google.protobuf/protobuf-kotlin@3.21.7-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:eab58acd-c599-535e-8f37-c634857430df",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-7254 is fixed in version 3.21.7-tuxcare.2 of com.google.protobuf:protobuf-kotlin."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/com.google.protobuf/protobuf-kotlin@3.21.7-tuxcare.2"
    }
  ]
}