{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:30c3a146-f210-5e61-ba42-c2e41bb4285b",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "commons-configuration2",
      "purl": "pkg:maven/org.apache.commons/commons-configuration2@2.9.0-tuxcare.2",
      "type": "library",
      "group": "org.apache.commons",
      "bom-ref": "pkg:maven/org.apache.commons/commons-configuration2@2.9.0-tuxcare.2",
      "version": "2.9.0-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "commons-configuration2",
            "purl": "pkg:maven/org.apache.commons/commons-configuration2@2.9.0",
            "type": "library",
            "group": "org.apache.commons",
            "version": "2.9.0"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2020-1953",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.commons/commons-configuration2@2.9.0-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:f1c2ee36-96de-59ca-81d7-4f13088fb65f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-1953 does not affect version 2.9.0-tuxcare.2 of org.apache.commons:commons-configuration2. CVE-2020-1953 affects Apache Commons Configuration 2.2-2.6 via unsafe YAML parsing allowing arbitrary Java object instantiation. The target version 2.9.0 already contains the upstream fix (commit add7375c, March 2020) that prevents this vulnerability. The fix was later improved (commit 153d828c, Feb 2023) to use SnakeYAML's SafeConstructor, which blocks all class instantiation tags like !!java.io.FileOutputStream. Both commits were part of the upstream 2.9.0 release that TuxCare onboarded, not TuxCare backports. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.2, < 2.7), NVD (= 2.2; = 2.3; = 2.4; = 2.5; = 2.6), cve.org (= 2.2; = 2.3; = 2.4; = 2.5; = 2.6), Snyk (>= 2.2, < 2.7).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-33980",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.commons/commons-configuration2@2.9.0-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a5a1a6cf-bb58-55a9-9acc-cbb42bb7a73b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-33980 does not affect version 2.9.0-tuxcare.2 of org.apache.commons:commons-configuration2. CVE-2022-33980 does not affect this target. The vulnerability was fixed in Apache Commons Configuration 2.8.0 by removing the dangerous default lookups (SCRIPT, DNS, URL) from ConfigurationInterpolator. The target version 2.9.0-tuxcare.2 inherits this fix from the upstream 2.9.0 release, which was onboarded by TuxCare. The vulnerable code pattern (automatic registration of script/dns/url lookups in defaults) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.4, < 2.8.0), NVD (>= 2.4, < 2.8), cve.org (< 2.8.0), Snyk (>= 2.4, < 2.8).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-29131",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.commons/commons-configuration2@2.9.0-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a23603ca-8919-5f24-afbd-b23f09f4d1bd",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-29131 is fixed in version 2.9.0-tuxcare.2 of org.apache.commons:commons-configuration2."
      }
    },
    {
      "id": "CVE-2024-29133",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.commons/commons-configuration2@2.9.0-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:f655d33c-8c02-5804-9111-424d6b2081d7",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-29133 affects version 2.9.0-tuxcare.2 of org.apache.commons:commons-configuration2."
      }
    },
    {
      "id": "CVE-2026-45205",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.commons/commons-configuration2@2.9.0-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:6d92a627-089f-59ef-a313-e7ef993940f4",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-45205 is fixed in version 2.9.0-tuxcare.2 of org.apache.commons:commons-configuration2."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.commons/commons-configuration2@2.9.0-tuxcare.2"
    }
  ]
}