{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:aa27cb26-39ac-5c04-ab18-6feefa55f682",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "apache-artemis",
      "purl": "pkg:maven/org.apache.activemq/apache-artemis@2.40.0-tuxcare.4",
      "type": "library",
      "group": "org.apache.activemq",
      "bom-ref": "pkg:maven/org.apache.activemq/apache-artemis@2.40.0-tuxcare.4",
      "version": "2.40.0-tuxcare.4",
      "pedigree": {
        "ancestors": [
          {
            "name": "apache-artemis",
            "purl": "pkg:maven/org.apache.activemq/apache-artemis@2.40.0",
            "type": "library",
            "group": "org.apache.activemq",
            "version": "2.40.0"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2020-13932",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/apache-artemis@2.40.0-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:adafb8ad-4e49-5752-8119-96f1176a1607",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-13932 does not affect version 2.40.0-tuxcare.4 of org.apache.activemq:apache-artemis. not_affected \u2014 CVE-2020-13932 XSS vulnerability not present in target. The vulnerable code (artemis-hawtio/artemis-plugin/src/main/webapp/plugin/js/brokerDiagram.js) was fixed by upstream commit a69b2aee7b (July 2020) which added HTML escaping via Core.escapeHtml() to prevent XSS in MQTT client-ids and topic names. The file was subsequently deleted in commit 0ce173dcb5 (October 2020) during HawtIO 2 migration...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-26117",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/apache-artemis@2.40.0-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:034291cf-f1a6-5f24-b471-650d0a09be65",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-26117 does not affect version 2.40.0-tuxcare.4 of org.apache.activemq:apache-artemis. CVE-2021-26117 affects the LDAP login module when configured with anonymous LDAP access. The vulnerability allowed authentication bypass because the anonymous context was used to verify passwords instead of the user's credentials. The fix (commit ec1c5a96c74b from Sep 2020) forces \"simple\" authentication during password verification by explicitly setting Context.SECURITY_AUTHENTICATION before binding. This fix was already present in upstream Apache ActiveMQ Artemis 2.40.0 when TuxCare onboarded it in Jul 2026. The target is not affected because the vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.16.0), NVD (< 2.16.0), cve.org (< 2.16.0), Snyk (>= 1.2.0, < 2.16.0).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.activemq/apache-artemis@2.40.0-tuxcare.4"
    }
  ]
}