{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:181d8efc-c5f8-5d6b-a749-e3e3fbfbb8ff",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "groovy",
      "purl": "pkg:maven/org.codehaus.groovy/groovy@2.5.8-tuxcare.1",
      "type": "library",
      "group": "org.codehaus.groovy",
      "bom-ref": "pkg:maven/org.codehaus.groovy/groovy@2.5.8-tuxcare.1",
      "version": "2.5.8-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "groovy",
            "purl": "pkg:maven/org.codehaus.groovy/groovy@2.5.8",
            "type": "library",
            "group": "org.codehaus.groovy",
            "version": "2.5.8"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2015-3253",
      "affects": [
        {
          "ref": "pkg:maven/org.codehaus.groovy/groovy@2.5.8-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:bf6d5ba4-213b-5d4e-97fb-4e537e7ea28b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2015-3253 does not affect version 2.5.8-tuxcare.1 of org.codehaus.groovy:groovy. CVE-2015-3253 affects MethodClosure deserialization in Apache Groovy versions 1.7.0 through 2.4.3. The target repository is Apache Groovy 2.5.8-tuxcare.1, which contains the upstream vendor's fix. Two fix commits (09e9778e8a adding readResolve() and 716d3e67e7 adding readObject()) were already present in the upstream 2.5.8 release when TuxCare onboarded it. Both methods block deserialization by throwing UnsupportedOperationException unless the opt-in flag ALLOW_RESOLVE is enabled (defaults to false, never set to true in codebase). The vulnerable pattern is not present at HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.7.0, < 2.4.4; >= 1.7.0, < 2.4.4), NVD (= 1.7.0; = 1.7.0-beta_1; = 1.7.0-beta_2; = 1.7.0-rc1; = 1.7.0-rc2; = 1.7.1; = 1.7.2; = 1.7.3; = 1.7.4; = 1.7.5; = 1.7.6; = 1.7.7; = 1.7.8; = 1.7.9; = 1.7.10; = 1.7.11; = 1.8.0; = 1.8.0-beta_1; = 1.8.0-beta_2; = 1.8.0-beta_3; = 1.8.0-beta_4; = 1.8.0-rc1; = 1.8.0-rc2; = 1.8.0-rc3; = 1.8.0-rc4; = 1.8.1; = 1.8.2; = 1.8.3; = 1.8.4; = 1.8.5; = 1.8.6; = 1.8.7; = 1.8.8; = 1.8.9; = 1.9.0; = 1.9.0-beta_1; = 1.9.0-beta_3; = 1.9.0-beta_4; = 2.0.0; = 2.0.0-beta_1; = 2.0.0-beta_2; = 2.0.0-beta_3; = 2.0.0-rc1; = 2.0.0-rc2; = 2.0.0-rc3; = 2.0.0-rc4; = 2.0.1; = 2.0.2; = 2.0.3; = 2.0.4; = 2.0.5; = 2.0.6; = 2.0.7; = 2.0.8; = 2.1.0; = 2.1.0-beta_1; = 2.1.0-rc1; = 2.1.0-rc2; = 2.1.0-rc3; = 2.1.1; = 2.1.2; = 2.1.3; = 2.1.4; = 2.1.5; = 2.1.6; = 2.1.7; = 2.1.8; = 2.1.9; = 2.2.0; = 2.2.0-beta_1; = 2.2.0-beta_2; = 2.2.0-rc1; = 2.2.0-rc2; = 2.2.0-rc3; = 2.2.1; = 2.2.2; = 2.3.0; = 2.3.0-beta_1; = 2.3.0-beta_2; = 2.3.0-rc1; = 2.3.0-rc2; = 2.3.0-rc3; = 2.3.1; = 2.3.2; = 2.3.3; = 2.3.4; = 2.3.5; = 2.3.6; = 2.3.7; = 2.3.8; = 2.3.9; = 2.3.10; = 2.3.11; = 2.4.0; = 2.4.0-beta_1; = 2.4.0-beta_2; = 2.4.0-beta_3; = 2.4.0-beta_4; = 2.4.0-rc1; = 2.4.0-rc2; = 2.4.1; = 2.4.2; = 2.4.3), Snyk (>= 1.7.0, < 2.4.4; <= 0; <= 0).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-6814",
      "affects": [
        {
          "ref": "pkg:maven/org.codehaus.groovy/groovy@2.5.8-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:7cca11bf-f468-5b1e-b023-ba09519ad0a0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-6814 does not affect version 2.5.8-tuxcare.1 of org.codehaus.groovy:groovy. CVE-2016-6814: Groovy 2.5.8-tuxcare.1 is not affected. The deserialization vulnerability in MethodClosure was fixed by upstream developer Jochen Theodorou (commit 716d3e67e7, 2016-10-03) and shipped in the upstream Groovy 2.5.8 release before TuxCare onboarding. The readObject() method blocks deserialization by throwing UnsupportedOperationException unless ALLOW_RESOLVE is true (default false, never set to true in codebase). The vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.7.0, < 2.4.8; >= 1.7.0, < 2.4.8), NVD (>= 1.7.0, <= 2.4.3; >= 2.4.4, <= 2.4.7), Snyk (< 2.4.7; <= 0).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-17521",
      "affects": [
        {
          "ref": "pkg:maven/org.codehaus.groovy/groovy@2.5.8-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:4bff98fe-b0a5-5f9b-af2d-aec14569c219",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-17521 affects version 2.5.8-tuxcare.1 of org.codehaus.groovy:groovy."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.codehaus.groovy/groovy@2.5.8-tuxcare.1"
    }
  ]
}