{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:3f1ced8d-9402-541c-aef2-e2c5dac97b10",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat-juli",
      "purl": "pkg:maven/org.apache.tomcat/tomcat-juli@7.0.70-tuxcare.7",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-juli@7.0.70-tuxcare.7",
      "version": "7.0.70-tuxcare.7",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat-juli",
            "purl": "pkg:maven/org.apache.tomcat/tomcat-juli@7.0.70",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "7.0.70"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2007-5342",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-juli@7.0.70-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:c4a626c5-81a8-5e1b-8954-c3b060b2de19",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2007-5342 does not affect version 7.0.70-tuxcare.7 of org.apache.tomcat:tomcat-juli. not_affected \u2014 The target Tomcat 7.0.70 is not affected by CVE-2007-5342. The vulnerability (granting AllPermission to JULI logging component in catalina.policy) was fixed by upstream Apache in December 2007. The fix was already included in the upstream 7.0.70 release (2016) that TuxCare onboarded. The current catalina.policy restricts JULI to minimal necessary permissions (file I/O only to ${catalina.base}/l...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2012-5568",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-juli@7.0.70-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:0ba28c49-7191-5fcb-9e28-69589ccbe895",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2012-5568 affects version 7.0.70-tuxcare.7 of org.apache.tomcat:tomcat-juli and will not be fixed. Apache does not treat CVE-2012-5568 as a Tomcat vulnerability and ships no fix; mitigation is connector configuration.",
        "response": [
          "will_not_fix"
        ]
      }
    },
    {
      "id": "CVE-2019-2684",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-juli@7.0.70-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:6cba770c-8cbb-5473-bd44-398dc446ac57",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2019-2684 is fixed in version 7.0.70-tuxcare.7 of org.apache.tomcat:tomcat-juli."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat-juli@7.0.70-tuxcare.7"
    }
  ]
}