{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:b5f51792-ce69-55bb-b78a-1accbc9492ab",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "plexus-utils",
      "purl": "pkg:maven/org.codehaus.plexus/plexus-utils@3.0.18-tuxcare.2",
      "type": "library",
      "group": "org.codehaus.plexus",
      "bom-ref": "pkg:maven/org.codehaus.plexus/plexus-utils@3.0.18-tuxcare.2",
      "version": "3.0.18-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "plexus-utils",
            "purl": "pkg:maven/org.codehaus.plexus/plexus-utils@3.0.18",
            "type": "library",
            "group": "org.codehaus.plexus",
            "version": "3.0.18"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2017-1000487",
      "affects": [
        {
          "ref": "pkg:maven/org.codehaus.plexus/plexus-utils@3.0.18-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:915707e0-6be7-553b-9d43-baf3c6335adc",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-1000487 does not affect version 3.0.18-tuxcare.2 of org.codehaus.plexus:plexus-utils. CVE-2017-1000487 affects plexus-utils versions before 3.0.16 due to improper handling of double-quoted strings in shell command execution, allowing command injection. The target repository is plexus-utils version 3.0.18-tuxcare.2. The upstream fix (commit b38a1b3 by krosenvold@apache.org from October 2013) was already present in upstream version 3.0.18 when TuxCare onboarded it. The fix eliminates shell interpretation by using direct process execution with raw argument arrays instead of shell-processed strings, and when shell quoting is needed for code generation, replaces vulnerable double-quote-based quoting with safer single-quote-based quoting that prevents variable expansion and command substitution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.16), NVD (< 3.0.16), Snyk (< 3.0.16).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-4244",
      "affects": [
        {
          "ref": "pkg:maven/org.codehaus.plexus/plexus-utils@3.0.18-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:fbbdbf0e-f821-5c1a-97e9-4b6e101612b9",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-4244 is fixed in version 3.0.18-tuxcare.2 of org.codehaus.plexus:plexus-utils."
      }
    },
    {
      "id": "CVE-2022-4245",
      "affects": [
        {
          "ref": "pkg:maven/org.codehaus.plexus/plexus-utils@3.0.18-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:8bcab97d-4301-562e-b7aa-cb252915b336",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-4245 is fixed in version 3.0.18-tuxcare.2 of org.codehaus.plexus:plexus-utils."
      }
    },
    {
      "id": "CVE-2025-67030",
      "affects": [
        {
          "ref": "pkg:maven/org.codehaus.plexus/plexus-utils@3.0.18-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:1f2dff22-e385-5166-8473-c64b280e531d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-67030 is fixed in version 3.0.18-tuxcare.2 of org.codehaus.plexus:plexus-utils."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.codehaus.plexus/plexus-utils@3.0.18-tuxcare.2"
    }
  ]
}