{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:7fa87ae3-2957-54f0-9eef-bdda89135104",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "retrofit",
      "purl": "pkg:maven/com.squareup.retrofit2/retrofit@2.7.2-tuxcare.1",
      "type": "library",
      "group": "com.squareup.retrofit2",
      "bom-ref": "pkg:maven/com.squareup.retrofit2/retrofit@2.7.2-tuxcare.1",
      "version": "2.7.2-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "retrofit",
            "purl": "pkg:maven/com.squareup.retrofit2/retrofit@2.7.2",
            "type": "library",
            "group": "com.squareup.retrofit2",
            "version": "2.7.2"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1000844",
      "affects": [
        {
          "ref": "pkg:maven/com.squareup.retrofit2/retrofit@2.7.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:87e7052d-1dac-5a12-a410-ddde90bdbb1e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1000844 does not affect version 2.7.2-tuxcare.1 of com.squareup.retrofit2:retrofit. CVE-2018-1000844 describes an XML External Entity (XXE) vulnerability in Retrofit's JAXB converter allowing attackers to read local files or perform SSRF via malicious XML containing external entity references or DTD declarations. The vendor fix (commit 4a693c5a by Jesse Wilson, April 2018) disables external entity resolution and DTD support in XMLInputFactory before XML parsing. This fix is present in the target at retrofit-converters/jaxb/src/main/java/retrofit2/converter/jaxb/JaxbResponseConverter.java lines 37-39. The fix was authored by upstream (jwilson@squareup.com) and shipped in Retrofit 2.7.2 before TuxCare onboarded the version (commit 4921bcfe). The target is not affected because the vulnerable code pattern (unrestricted external entity resolution) is not present\u2014the upstream vendor's defense was already in place at onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.5.0), NVD (>= 2.4.0, < 2.5.0), Snyk (< 2.5.0).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1000850",
      "affects": [
        {
          "ref": "pkg:maven/com.squareup.retrofit2/retrofit@2.7.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8173fba1-cf28-5ab1-aee3-fe96a4c43ebb",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1000850 does not affect version 2.7.2-tuxcare.1 of com.squareup.retrofit2:retrofit. The target repository (Retrofit 2.7.2-tuxcare.1) contains the PATH_TRAVERSAL defense that prevents directory traversal via @Path parameters. This defense validates that path parameter substitution does not create URLs containing `.` or `..` as complete path segments (including percent-encoded forms %2e/%2E), throwing an exception if detected. The fix was introduced by upstream commit b9a7f6ad (author: Jesse Wilson <jwilson@squareup.com>) and was already present in the upstream release 2.7.2 that TuxCare onboarded (first TuxCare commit: 4921bcfe). The vulnerable code pattern is not present because the upstream vendor's fix was already included in the release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.5.0), NVD (>= 2.0.0, < 2.5.0), Snyk (>= 2.0.0, < 2.5.0).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/com.squareup.retrofit2/retrofit@2.7.2-tuxcare.1"
    }
  ]
}