{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:1fc94cd4-63d1-54f3-842a-90b7a779eabc",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "activemq-openwire-legacy",
      "purl": "pkg:maven/org.apache.activemq/activemq-openwire-legacy@6.1.8-tuxcare.2",
      "type": "library",
      "group": "org.apache.activemq",
      "bom-ref": "pkg:maven/org.apache.activemq/activemq-openwire-legacy@6.1.8-tuxcare.2",
      "version": "6.1.8-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "activemq-openwire-legacy",
            "purl": "pkg:maven/org.apache.activemq/activemq-openwire-legacy@6.1.8",
            "type": "library",
            "group": "org.apache.activemq",
            "version": "6.1.8"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2023-46604",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/activemq-openwire-legacy@6.1.8-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:0921ccb4-b874-59cb-ae85-1cbbfb54f7aa",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-46604 does not affect version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-openwire-legacy. The target repository (Apache ActiveMQ 6.1.8-tuxcare.2) is NOT vulnerable to CVE-2023-46604. The upstream Apache fix (commit 3eaf3107f by Christopher L. Shannon) was already present in the ActiveMQ 6.1.8 release that TuxCare onboarded. The fix adds OpenWireUtil.validateIsThrowable() validation in BaseDataStreamMarshaller.createThrowable() across all OpenWire protocol versions (v1-v12), preventing arbitrary class instantiation by validating that deserialized class names are assignable to Throwable before instantiation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 5.15.16; >= 5.16.0, < 5.16.7; >= 5.17.0, < 5.17.6; >= 5.18.0, < 5.18.3; >= 5.8.0, < 5.15.16; >= 5.16.0, < 5.16.7; >= 5.17.0, < 5.17.6; >= 5.18.0, < 5.18.3), NVD (< 5.15.16; >= 5.16.0, < 5.16.7; >= 5.17.0, < 5.17.6; >= 5.18.0, < 5.18.3; < 5.15.16; >= 5.16.0, < 5.16.7; >= 5.17.0, < 5.17.6; >= 5.18.0, < 5.18.3), cve.org (>= 5.18.0, < 5.18.3; >= 5.17.0, < 5.17.6; >= 5.16.0, < 5.16.7; < 5.15.16; >= 5.18.0, < 5.18.3; >= 5.17.0, < 5.17.6; >= 5.16.0, < 5.16.7; >= 5.8.0, < 5.15.16), Snyk (< 5.15.16; >= 5.16.0, < 5.16.7; >= 5.17.0, < 5.17.6; >= 5.18.0, < 5.18.3; < 5.15.16; >= 5.16.0, < 5.16.7; >= 5.17.0, < 5.17.6; >= 5.18.0, < 5.18.3).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-27533",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/activemq-openwire-legacy@6.1.8-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:4c973309-852e-51ef-a2bc-00c42554f257",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-27533 does not affect version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-openwire-legacy. not_affected \u2014 CVE-2025-27533 (unvalidated buffer sizes during OpenWire unmarshalling) is NOT present in ActiveMQ 6.1.8-tuxcare.2. The fix was authored by Apache upstream (Christopher L. Shannon, cshannon@apache.org) and shipped in ActiveMQ 6.1.8 upstream release, which TuxCare then onboarded. The complete defense is present: validateBufferSize() validates size values before allocation, MarshallingContext tra...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.activemq/activemq-openwire-legacy@6.1.8-tuxcare.2"
    }
  ]
}