{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:c072ea0b-72c0-52af-87cc-5c9ff4b7b4f3",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "activemq-jaas",
      "purl": "pkg:maven/org.apache.activemq/activemq-jaas@6.1.6-tuxcare.3",
      "type": "library",
      "group": "org.apache.activemq",
      "bom-ref": "pkg:maven/org.apache.activemq/activemq-jaas@6.1.6-tuxcare.3",
      "version": "6.1.6-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "activemq-jaas",
            "purl": "pkg:maven/org.apache.activemq/activemq-jaas@6.1.6",
            "type": "library",
            "group": "org.apache.activemq",
            "version": "6.1.6"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2014-3612",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/activemq-jaas@6.1.6-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:62587185-7c0a-5c17-a888-1a569467b6d7",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2014-3612 does not affect version 6.1.6-tuxcare.3 of org.apache.activemq:activemq-jaas. CVE-2014-3612 is not present in Apache ActiveMQ 6.1.6. The vulnerability allowed authentication bypass via empty password triggering unauthenticated LDAP bind. The upstream fix (commit 0b5231ada from September 2014) was already present in the ActiveMQ 6.1.6 release that TuxCare onboarded. All LDAP authentication modules (LDAPLoginModule, LDAPAuthorizationMap, SimpleCachedLDAPAuthorizationMap, LdapNetworkConnector) contain explicit validation that rejects empty username or empty password before LDAP bind operations, throwing NamingException with message \"Empty username is not allowed\" or \"Empty password is not allowed\". The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0, < 5.10.1; >= 5.0.0, < 5.10.1), NVD (= 5.0.0; = 5.1.0; = 5.2.0; = 5.3.0; = 5.3.1; = 5.3.2; = 5.4.0; = 5.4.1; = 5.4.2; = 5.4.3; = 5.5.0; = 5.5.1; = 5.6.0; = 5.7.0; = 5.8.0; = 5.9.0; = 5.9.1; = 5.10.0), Snyk (>= 5.0.0, < 5.10.1; >= 5.0.0, < 5.10.1; <= 0; >= 5.0.0, < 5.10.1; <= 0).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2015-6524",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/activemq-jaas@6.1.6-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:3941b92f-89fa-5786-999b-891129c089e3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2015-6524 does not affect version 6.1.6-tuxcare.3 of org.apache.activemq:activemq-jaas. not_affected \u2014 CVE-2015-6524 does not affect this version. The vulnerability (LDAP filter injection via unescaped wildcards in usernames) was fixed in upstream Apache ActiveMQ commit 0b5231ada (AMQ-5345) by Dejan Bosanac, which was already present in ActiveMQ 6.1.6 when TuxCare onboarded it. The fix applies RFC 2254 encoding to usernames before LDAP filter construction, converting wildcards like '*' to '\\2a',...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.activemq/activemq-jaas@6.1.6-tuxcare.3"
    }
  ]
}