{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:24fadfbe-0ce6-5660-9735-a50c09802d73",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "commons-configuration2",
      "purl": "pkg:maven/org.apache.commons/commons-configuration2@2.8.0-tuxcare.2",
      "type": "library",
      "group": "org.apache.commons",
      "bom-ref": "pkg:maven/org.apache.commons/commons-configuration2@2.8.0-tuxcare.2",
      "version": "2.8.0-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "commons-configuration2",
            "purl": "pkg:maven/org.apache.commons/commons-configuration2@2.8.0",
            "type": "library",
            "group": "org.apache.commons",
            "version": "2.8.0"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2020-1953",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.commons/commons-configuration2@2.8.0-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:6cf8bbd4-0ad3-5d8a-8324-8fbe4dc77bcd",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-1953 does not affect version 2.8.0-tuxcare.2 of org.apache.commons:commons-configuration2. CVE-2020-1953: The target repository (commons-configuration2 version 2.8.0-tuxcare.2) is NOT AFFECTED. The vulnerability involves unsafe YAML parsing that allows arbitrary Java object instantiation via SnakeYAML's default class loading behavior. The fix (commit add7375c, authored by oliver.heger@oliver-heger.de on 2020-03-04) was already present in the upstream Apache Commons Configuration 2.7 release (2020-03-07) and is therefore included in version 2.8.0 that TuxCare onboarded. The fix prevents class loading by overriding the YAML Constructor's getClassForName() method to throw an exception, effectively blocking the attack chain from YAML class instantiation directives to arbitrary code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.2, < 2.7), NVD (= 2.2; = 2.3; = 2.4; = 2.5; = 2.6), cve.org (= 2.2; = 2.3; = 2.4; = 2.5; = 2.6), Snyk (>= 2.2, < 2.7).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-33980",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.commons/commons-configuration2@2.8.0-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:1cc20223-6c6a-5131-8a98-df38aadae926",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-33980 does not affect version 2.8.0-tuxcare.2 of org.apache.commons:commons-configuration2. Target version 2.8.0-tuxcare.2 is NOT AFFECTED by CVE-2022-33980. The vulnerability required dangerous lookups (script, dns, url) to be enabled by default in variable interpolation. The fix (commit f025bc399e81) removed these lookups from the default set by modifying ConfigurationInterpolator.createDefaultLookups() to explicitly exclude them. This fix was authored by upstream Apache maintainer mattjuntunen@apache.org and was already present in the upstream 2.8.0 release when TuxCare onboarded it (commit 3de2350a \"Onboard version 2.8.0\"). The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4, < 2.8.0), NVD (>= 2.4, < 2.8), cve.org (< 2.8.0), Snyk (>= 2.4, < 2.8).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-29131",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.commons/commons-configuration2@2.8.0-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:c47cf075-dc5a-51ac-9566-fb1708bc32eb",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-29131 is fixed in version 2.8.0-tuxcare.2 of org.apache.commons:commons-configuration2."
      }
    },
    {
      "id": "CVE-2024-29133",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.commons/commons-configuration2@2.8.0-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:d98cf9fc-81e5-579e-83bf-9746c653f0cf",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-29133 does not affect version 2.8.0-tuxcare.2 of org.apache.commons:commons-configuration2. not_affected \u2014 Version 2.8.0 is not affected by CVE-2024-29133. The vulnerable public interface method `ListDelimiterHandler.flatten(Object, int)` was introduced in version 2.9.0 (commit c034d659, July 14, 2022), after version 2.8.0 was released (July 4, 2022). The CVE describes a bug in cycle-detection initialization that was introduced in March 2024 (commit 7d7d399d) and fixed the next day (commit 43f4dab0)...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-45205",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.commons/commons-configuration2@2.8.0-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:0bfd4878-c7f0-5e8c-acbd-b823922bda8a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-45205 is fixed in version 2.8.0-tuxcare.2 of org.apache.commons:commons-configuration2."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.commons/commons-configuration2@2.8.0-tuxcare.2"
    }
  ]
}