{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:08bb20bf-e75f-5e68-9232-d8c6df67780f",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "qpid-jms-client",
      "purl": "pkg:maven/org.apache.qpid/qpid-jms-client@1.10.0-tuxcare.1",
      "type": "library",
      "group": "org.apache.qpid",
      "bom-ref": "pkg:maven/org.apache.qpid/qpid-jms-client@1.10.0-tuxcare.1",
      "version": "1.10.0-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "qpid-jms-client",
            "purl": "pkg:maven/org.apache.qpid/qpid-jms-client@1.10.0",
            "type": "library",
            "group": "org.apache.qpid",
            "version": "1.10.0"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2016-4974",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.qpid/qpid-jms-client@1.10.0-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:309b5712-6640-5820-8f86-435a40603869",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-4974 does not affect version 1.10.0-tuxcare.1 of org.apache.qpid:qpid-jms-client. not_affected \u2014 CVE-2016-4974 affects Apache Qpid JMS (AMQP 1.0) versions before 0.10.0. The target version 1.10.0 contains the deserialization policy defense mechanism introduced in upstream version 0.10.0 (commit 669cfff8, June 2016). The defense includes JmsDeserializationPolicy with allow/deny list filtering integrated into ClassLoadingAwareObjectInputStream, which validates classes before deserialization....",
        "justification": "requires_configuration"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.qpid/qpid-jms-client@1.10.0-tuxcare.1"
    }
  ]
}