{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:d1ebdd66-7cbc-5d2e-983b-f736e523c977",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "activemq-openwire-legacy",
      "purl": "pkg:maven/org.apache.activemq/activemq-openwire-legacy@6.1.6-tuxcare.2",
      "type": "library",
      "group": "org.apache.activemq",
      "bom-ref": "pkg:maven/org.apache.activemq/activemq-openwire-legacy@6.1.6-tuxcare.2",
      "version": "6.1.6-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "activemq-openwire-legacy",
            "purl": "pkg:maven/org.apache.activemq/activemq-openwire-legacy@6.1.6",
            "type": "library",
            "group": "org.apache.activemq",
            "version": "6.1.6"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2023-46604",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/activemq-openwire-legacy@6.1.6-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:adf164d8-8de7-500e-9e73-3688a89d2641",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-46604 does not affect version 6.1.6-tuxcare.2 of org.apache.activemq:activemq-openwire-legacy. CVE-2023-46604 (Remote Code Execution via OpenWire protocol) is NOT present in activemq-parent:6.1.6-tuxcare.3. The vulnerability allowed attackers to instantiate arbitrary classes on the classpath by sending malicious serialized class names in OpenWire protocol data. The fix (adding Throwable type validation before reflective instantiation) was already present in the upstream Apache ActiveMQ 6.1.6 release that TuxCare onboarded, authored by Christopher L. Shannon (christopher.l.shannon@gmail.com) in commit 3eaf3107f. The vulnerable pattern (unvalidated Class.forName with attacker-controlled input) has been removed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 5.15.16; >= 5.16.0, < 5.16.7; >= 5.17.0, < 5.17.6; >= 5.18.0, < 5.18.3; >= 5.8.0, < 5.15.16; >= 5.16.0, < 5.16.7; >= 5.17.0, < 5.17.6; >= 5.18.0, < 5.18.3), NVD (< 5.15.16; >= 5.16.0, < 5.16.7; >= 5.17.0, < 5.17.6; >= 5.18.0, < 5.18.3; < 5.15.16; >= 5.16.0, < 5.16.7; >= 5.17.0, < 5.17.6; >= 5.18.0, < 5.18.3), cve.org (>= 5.18.0, < 5.18.3; >= 5.17.0, < 5.17.6; >= 5.16.0, < 5.16.7; < 5.15.16; >= 5.18.0, < 5.18.3; >= 5.17.0, < 5.17.6; >= 5.16.0, < 5.16.7; >= 5.8.0, < 5.15.16), Snyk (< 5.15.16; >= 5.16.0, < 5.16.7; >= 5.17.0, < 5.17.6; >= 5.18.0, < 5.18.3; < 5.15.16; >= 5.16.0, < 5.16.7; >= 5.17.0, < 5.17.6; >= 5.18.0, < 5.18.3).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-27533",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/activemq-openwire-legacy@6.1.6-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:61a7d0a7-4009-5b28-afae-d21b9e00bb16",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-27533 does not affect version 6.1.6-tuxcare.2 of org.apache.activemq:activemq-openwire-legacy. not_affected \u2014 Apache ActiveMQ 6.1.6 is NOT affected by CVE-2025-27533. The vulnerability (excessive memory allocation during OpenWire command unmarshalling due to unvalidated buffer size values) was fixed in upstream commit 610cc9aca8a2 authored by Christopher L. Shannon (cshannon@apache.org). This fix was already present in the upstream 6.1.6 release when TuxCare onboarded it (first TuxCare commit 974edcfe4...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.activemq/activemq-openwire-legacy@6.1.6-tuxcare.2"
    }
  ]
}