{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:f69d4f39-3d67-5dac-a150-67dc8b967b2e",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "bcprov-debug-jdk18on",
      "purl": "pkg:maven/org.bouncycastle/bcprov-debug-jdk18on@1.75-tuxcare.1",
      "type": "library",
      "group": "org.bouncycastle",
      "bom-ref": "pkg:maven/org.bouncycastle/bcprov-debug-jdk18on@1.75-tuxcare.1",
      "version": "1.75-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "bcprov-debug-jdk18on",
            "purl": "pkg:maven/org.bouncycastle/bcprov-debug-jdk18on@1.75",
            "type": "library",
            "group": "org.bouncycastle",
            "version": "1.75"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2023-33201",
      "affects": [
        {
          "ref": "pkg:maven/org.bouncycastle/bcprov-debug-jdk18on@1.75-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:4de434d3-d27f-5b0c-8e7f-ed4166dc19ed",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-33201 does not affect version 1.75-tuxcare.1 of org.bouncycastle:bcprov-debug-jdk18on. not_affected \u2014 CVE-2023-33201 (LDAP injection via unescaped X.500 names) is not present in bc-java 1.75. The fix was already included in the upstream Bouncy Castle 1.75 release that TuxCare onboarded. All X.500 distinguished names from certificate subjects and issuers are escaped via LDAPUtils.parseDN() \u2192 filterEncode() before being used in LDAP search filters, preventing injection of LDAP filter operators (*...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-14813",
      "affects": [
        {
          "ref": "pkg:maven/org.bouncycastle/bcprov-debug-jdk18on@1.75-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:93098ef7-1265-516c-900c-1d67ea78a9e9",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-14813 is fixed in version 1.75-tuxcare.1 of org.bouncycastle:bcprov-debug-jdk18on."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.bouncycastle/bcprov-debug-jdk18on@1.75-tuxcare.1"
    }
  ]
}