{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:7c0f0a41-f764-5009-b28b-c8eb36f3b2c9",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "activemq-openwire-generator",
      "purl": "pkg:maven/org.apache.activemq/activemq-openwire-generator@6.1.6-tuxcare.2",
      "type": "library",
      "group": "org.apache.activemq",
      "bom-ref": "pkg:maven/org.apache.activemq/activemq-openwire-generator@6.1.6-tuxcare.2",
      "version": "6.1.6-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "activemq-openwire-generator",
            "purl": "pkg:maven/org.apache.activemq/activemq-openwire-generator@6.1.6",
            "type": "library",
            "group": "org.apache.activemq",
            "version": "6.1.6"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2017-15709",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/activemq-openwire-generator@6.1.6-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:2270392d-7ece-5bff-b82f-913aa8dec5a1",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-15709 does not affect version 6.1.6-tuxcare.2 of org.apache.activemq:activemq-openwire-generator. not_affected \u2014 CVE-2017-15709 affects ActiveMQ 5.14.0-5.15.2, where the OpenWire protocol client unconditionally exposed detailed platform information (JVM version, OS name, OS version, OS architecture) during connection handshake. The target repository (ActiveMQ 6.1.6) already contains the upstream fix (commit 5fa0bbd5, AMQ-6871) that defaults to sending a generic 'Java' string instead. This fix was shipped ...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.activemq/activemq-openwire-generator@6.1.6-tuxcare.2"
    }
  ]
}