{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:5235b41f-b0ea-536f-9a78-b61c7bd3867c",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat-servlet-api",
      "purl": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@9.0.13-tuxcare.4",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@9.0.13-tuxcare.4",
      "version": "9.0.13-tuxcare.4",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat-servlet-api",
            "purl": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@9.0.13",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "9.0.13"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2001-0590",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@9.0.13-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:f82ae0d3-1d51-5e4b-8805-3c78e6b09c94",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2001-0590 does not affect version 9.0.13-tuxcare.4 of org.apache.tomcat:tomcat-servlet-api. not_affected \u2014 CVE-2001-0590 affects Apache Tomcat versions prior to 3.2.2 (released in 2001) and concerns malformed HTTP requests without protocol specifications serving JSP source code instead of executing them. The target repository is Tomcat 9.0.13 (released 2018), which is 17 years newer than the vulnerable versions. The fix for this ancient vulnerability was included in Tomcat 3.2.2 and has been maintai...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat-servlet-api@9.0.13-tuxcare.4"
    }
  ]
}