{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:3b72c46b-e3dc-506e-8160-42453877d7e6",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "artemis-project",
      "purl": "pkg:maven/org.apache.activemq/artemis-project@2.40.0-tuxcare.4",
      "type": "library",
      "group": "org.apache.activemq",
      "bom-ref": "pkg:maven/org.apache.activemq/artemis-project@2.40.0-tuxcare.4",
      "version": "2.40.0-tuxcare.4",
      "pedigree": {
        "ancestors": [
          {
            "name": "artemis-project",
            "purl": "pkg:maven/org.apache.activemq/artemis-project@2.40.0",
            "type": "library",
            "group": "org.apache.activemq",
            "version": "2.40.0"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2025-27391",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/artemis-project@2.40.0-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:52c5edad-04c9-5b65-8b2b-e77e9ebcf84f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-27391 does not affect version 2.40.0-tuxcare.4 of org.apache.activemq:artemis-project. not_affected \u2014 Target Apache ActiveMQ Artemis 2.40.0 is not affected by CVE-2025-27391. The vulnerability involved logging sensitive broker property values (passwords, credentials) in debug mode without redaction. The upstream Apache fix (commit 091c439073) shipped in version 2.40.0 adds redaction logic that replaces sensitive values with \"**redacted**\" before logging. This fix was part of the upstream releas...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.activemq/artemis-project@2.40.0-tuxcare.4"
    }
  ]
}