{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:6130785e-5e87-5187-8d2c-d0ac50865a2f",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "bcprov-ext-debug-jdk15on",
      "purl": "pkg:maven/org.bouncycastle/bcprov-ext-debug-jdk15on@1.52-tuxcare.1",
      "type": "library",
      "group": "org.bouncycastle",
      "bom-ref": "pkg:maven/org.bouncycastle/bcprov-ext-debug-jdk15on@1.52-tuxcare.1",
      "version": "1.52-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "bcprov-ext-debug-jdk15on",
            "purl": "pkg:maven/org.bouncycastle/bcprov-ext-debug-jdk15on@1.52",
            "type": "library",
            "group": "org.bouncycastle",
            "version": "1.52"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2015-6644",
      "affects": [
        {
          "ref": "pkg:maven/org.bouncycastle/bcprov-ext-debug-jdk15on@1.52-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:cfe1d1a7-1936-5c18-ae78-5a65a12cc3ef",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-6644 affects version 1.52-tuxcare.1 of org.bouncycastle:bcprov-ext-debug-jdk15on."
      }
    },
    {
      "id": "CVE-2020-0187",
      "affects": [
        {
          "ref": "pkg:maven/org.bouncycastle/bcprov-ext-debug-jdk15on@1.52-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:23f680c8-23d3-5f76-b67e-9e8c95bf983b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-0187 does not affect version 1.52-tuxcare.1 of org.bouncycastle:bcprov-ext-debug-jdk15on. not_affected \u2014 CVE-2020-0187 is an incomplete mode-name comparison in BaseBlockCipher.engineSetMode. The mode name is upper-cased, then compared case-sensitively to a mixed-case literal, so \"PGPCFBwithIV\" selects the wrong PGP CFB variant. This target already uses equalsIgnoreCase for both PGP comparisons, and has done so since the oldest commit in its history, which is in the upstream release. The patch diff...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.bouncycastle/bcprov-ext-debug-jdk15on@1.52-tuxcare.1"
    }
  ]
}