{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:f1979909-130e-5503-9764-354a423c7b24",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat-jasper",
      "purl": "pkg:maven/org.apache.tomcat/tomcat-jasper@9.0.75-tuxcare.8",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@9.0.75-tuxcare.8",
      "version": "9.0.75-tuxcare.8",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat-jasper",
            "purl": "pkg:maven/org.apache.tomcat/tomcat-jasper@9.0.75",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "9.0.75"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2016-5018",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@9.0.75-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:e6697023-0eaa-573e-a8d5-588e685430e0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-5018 does not affect version 9.0.75-tuxcare.8 of org.apache.tomcat:tomcat-jasper. CVE-2016-5018 is not present in Apache Tomcat 9.0.75. The vulnerability involved a SecurityManager bypass via JspRuntimeLibrary.introspecthelper() using AccessController.doPrivileged(). This was fixed upstream by Apache Tomcat in August 2016 (commit a6b1ebc246), long before version 9.0.75 was released. The target code does not contain the vulnerable pattern (PrivilegedIntrospectHelper class and doPrivileged wrapper are absent). The fix was already in the upstream release when TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0RC1, < 8.0.37; >= 7.0.0, < 7.0.72; >= 9.0.0.M1, < 9.0.0.M10; >= 8.5.0, < 8.5.5; >= 8.0.0RC1, < 8.0.37; >= 7.0.0, < 7.0.72; >= 6.0.0, < 6.0.47), NVD (>= 6.0.0, <= 6.0.45; >= 7.0.0, <= 7.0.70; >= 8.0, <= 8.0.36; >= 8.5.0, <= 8.5.4; = 9.0.0-milestone1; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M9; >= 8.5.0, <= 8.5.4; >= 8.0.0.RC1, <= 8.0.36; >= 7.0.0, <= 7.0.70; >= 6.0.0, <= 6.0.45), Snyk (>= 7.0.0, < 7.0.72; >= 8, < 8.0.37; >= 8.5.0, < 8.5.5; >= 9-alpha, < 9.0.0.M10).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat-jasper@9.0.75-tuxcare.8"
    }
  ]
}