{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:33377a78-077e-5819-b7c9-6438dbbafaee",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat-jasper",
      "purl": "pkg:maven/org.apache.tomcat/tomcat-jasper@8.5.46-tuxcare.2",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@8.5.46-tuxcare.2",
      "version": "8.5.46-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat-jasper",
            "purl": "pkg:maven/org.apache.tomcat/tomcat-jasper@8.5.46",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "8.5.46"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2016-5018",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@8.5.46-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:cddbf4c6-8aec-551f-85c7-c4c28228def9",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-5018 does not affect version 8.5.46-tuxcare.2 of org.apache.tomcat:tomcat-jasper. CVE-2016-5018 is not present in Tomcat 8.5.46. The vulnerability allowed malicious web applications to bypass SecurityManager restrictions via the PrivilegedIntrospectHelper class in JspRuntimeLibrary.java, which used AccessController.doPrivileged() to execute introspection logic with elevated privileges. The upstream Apache Tomcat project removed this vulnerable code in commit 648122fef8 (authored by markt@apache.org). Version 8.5.46 includes this upstream fix\u2014the PrivilegedIntrospectHelper class and privileged execution wrapper are completely absent from the codebase.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-2684",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@8.5.46-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:d562f1d8-087e-5a2f-bde0-d0707c78773c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-2684 does not affect version 8.5.46-tuxcare.2 of org.apache.tomcat:tomcat-jasper. not_affected \u2014 Tomcat 8.5.46 contains vulnerable JMX/RMI code that could expose CVE-2019-2684 (Java SE RMI deserialization), but this code is not reachable in the default shipped configuration. The vulnerable JmxRemoteLifecycleListener class exists in the codebase and uses the unpatched `LocateRegistry.createRegistry()` + `registry.bind()` pattern that allows unauthorized RMI registry modifications. However, ...",
        "justification": "code_not_reachable"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@8.5.46-tuxcare.2"
    }
  ]
}