{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:f6ce4b67-3f8e-5375-a1dc-7d006311cad5",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "c3p0",
      "purl": "pkg:maven/com.mchange/c3p0@0.9.5.3-tuxcare.2",
      "type": "library",
      "group": "com.mchange",
      "bom-ref": "pkg:maven/com.mchange/c3p0@0.9.5.3-tuxcare.2",
      "version": "0.9.5.3-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "c3p0",
            "purl": "pkg:maven/com.mchange/c3p0@0.9.5.3",
            "type": "library",
            "group": "com.mchange",
            "version": "0.9.5.3"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-20433",
      "affects": [
        {
          "ref": "pkg:maven/com.mchange/c3p0@0.9.5.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:4e3b07a0-49fe-5541-91ec-1e3a10b408b4",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-20433 does not affect version 0.9.5.3-tuxcare.2 of com.mchange:c3p0. CVE-2018-20433 (XXE in c3p0 XML configuration parsing) is NOT present in the target. The upstream vendor (Steve Waldman) fixed this vulnerability in commit 7dfdda63 before releasing c3p0 0.9.5.3. The fix was already included in the upstream release that TuxCare onboarded (commit aa2c9937). The vulnerable code pattern (unrestricted XML entity expansion) has been replaced with secure-by-default behavior: DocumentBuilderFactory.setExpandEntityReferences() is explicitly set to false, blocking XXE attacks unless users explicitly opt-in via system property com.mchange.v2.c3p0.cfg.xml.expandEntityReferences=true.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 0.9.5.3), NVD (= 0.9.5.2), Snyk (< 0.9.5.3).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-5427",
      "affects": [
        {
          "ref": "pkg:maven/com.mchange/c3p0@0.9.5.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:c2e40126-b08e-5fe3-a3ac-2c64da8ca67c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2019-5427 is fixed in version 0.9.5.3-tuxcare.2 of com.mchange:c3p0."
      }
    },
    {
      "id": "CVE-2026-27830",
      "affects": [
        {
          "ref": "pkg:maven/com.mchange/c3p0@0.9.5.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:0a2dce2f-a014-50d2-af13-46f1d7ed8c2c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-27830 affects version 0.9.5.3-tuxcare.2 of com.mchange:c3p0, and is fixed in 0.9.5.3-tuxcare.3."
      }
    },
    {
      "id": "CVE-2026-55223",
      "affects": [
        {
          "ref": "pkg:maven/com.mchange/c3p0@0.9.5.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:05cd6a4b-f01b-5fba-95db-4a0b37177693",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-55223 is fixed in version 0.9.5.3-tuxcare.2 of com.mchange:c3p0."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/com.mchange/c3p0@0.9.5.3-tuxcare.2"
    }
  ]
}