{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:16fbfed8-3b36-51e8-affd-d0b5212560cb",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "tomcat-websocket",
      "purl": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.55-tuxcare.1",
      "type": "library",
      "group": "org.apache.tomcat",
      "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.55-tuxcare.1",
      "version": "10.1.55-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "tomcat-websocket",
            "purl": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.55",
            "type": "library",
            "group": "org.apache.tomcat",
            "version": "10.1.55"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2020-13935",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.55-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d21b9cca-7993-5d83-837d-4747decb65b6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-13935 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-websocket. The target Tomcat 10.1.55 repository is NOT vulnerable to CVE-2020-13935. The fix for this WebSocket payload length validation vulnerability was already present in the upstream Apache Tomcat 10.1.55 release when TuxCare onboarded it. The required validation check (rejecting frames where the 64-bit payload length has its MSB set, resulting in a negative value) is present at WsFrameBase.java lines 254-257.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57; >= 7.0.27, < 7.0.105; >= 7.0.27, < 7.0.105; >= 8.5.0, < 8.5.57; >= 9.0.0.M1, < 9.0.37; >= 10.0.0-M1, < 10.0.0-M7; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57; >= 7.0.27, < 7.0.105), NVD (>= 7.0.27, <= 7.0.104; >= 8.5.0, <= 8.5.56; >= 9.0.1, <= 9.0.36; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4; = 10.0.0-milestone5; = 10.0.0-milestone6), cve.org (>= 10.0.0-M1, <= 10.0.0-M6; >= 9.0.0.M1, <= 9.0.36; >= 8.5.0, <= 8.5.56; >= 7.0.27, <= 7.0.104), Snyk (<= 0; >= 10.0.0-M1, < 10.0.0-M7; >= 9.0.0.M1, < 9.0.37; >= 8.5.0, < 8.5.57).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-23672",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.55-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:1fb1dcfb-4006-554b-b12f-6079c0425734",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-23672 does not affect version 10.1.55-tuxcare.1 of org.apache.tomcat:tomcat-websocket. not_affected \u2014 Apache Tomcat 10.1.55 is NOT affected by CVE-2024-23672. The vulnerability (incomplete WebSocket session cleanup leading to DoS) was fixed in upstream Apache Tomcat 10.1.19 and later versions. The target version 10.1.55 contains the complete fix, which was introduced by upstream commit 0052b37468 (authored by Mark Thomas, markt@apache.org, on 2024-01-18). This fix was already present in the ups...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.55-tuxcare.1"
    }
  ]
}