{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:7ff21fbd-c63e-51d3-b442-e5883363f42d",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "bcprov-debug-jdk18on",
      "purl": "pkg:maven/org.bouncycastle/bcprov-debug-jdk18on@1.77-tuxcare.4",
      "type": "library",
      "group": "org.bouncycastle",
      "bom-ref": "pkg:maven/org.bouncycastle/bcprov-debug-jdk18on@1.77-tuxcare.4",
      "version": "1.77-tuxcare.4",
      "pedigree": {
        "ancestors": [
          {
            "name": "bcprov-debug-jdk18on",
            "purl": "pkg:maven/org.bouncycastle/bcprov-debug-jdk18on@1.77",
            "type": "library",
            "group": "org.bouncycastle",
            "version": "1.77"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2023-33201",
      "affects": [
        {
          "ref": "pkg:maven/org.bouncycastle/bcprov-debug-jdk18on@1.77-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:9a696918-dd8a-5c84-b4b3-d6ad8bce020a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-33201 does not affect version 1.77-tuxcare.4 of org.bouncycastle:bcprov-debug-jdk18on. not_affected \u2014 The target bc-java 1.77 repository is NOT AFFECTED by CVE-2023-33201. The upstream fix for LDAP injection in X509LDAPCertStoreSpi was already present in the Bouncy Castle 1.77 release when TuxCare onboarded it. All X.500 names (subject, issuer) are escaped via LDAPUtils.parseDN() \u2192 filterEncode() before being used in LDAP queries, preventing injection of LDAP filter metacharacters.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-14813",
      "affects": [
        {
          "ref": "pkg:maven/org.bouncycastle/bcprov-debug-jdk18on@1.77-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:6ca56a0c-b952-54f3-88ae-74277760c194",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-14813 is fixed in version 1.77-tuxcare.4 of org.bouncycastle:bcprov-debug-jdk18on."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.bouncycastle/bcprov-debug-jdk18on@1.77-tuxcare.4"
    }
  ]
}