{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:9aec8fb1-dc2f-540e-a3ce-3da1be4f8b67",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-integration-xml",
      "purl": "pkg:maven/org.springframework.integration/spring-integration-xml@5.5.19-tuxcare.2",
      "type": "library",
      "group": "org.springframework.integration",
      "bom-ref": "pkg:maven/org.springframework.integration/spring-integration-xml@5.5.19-tuxcare.2",
      "version": "5.5.19-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-integration-xml",
            "purl": "pkg:maven/org.springframework.integration/spring-integration-xml@5.5.19",
            "type": "library",
            "group": "org.springframework.integration",
            "version": "5.5.19"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2019-3772",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-xml@5.5.19-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a6d21ccc-94c4-5393-9851-d67ff6d19979",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-3772 does not affect version 5.5.19-tuxcare.2 of org.springframework.integration:spring-integration-xml. CVE-2019-3772 (XXE vulnerability) is NOT present in Spring Integration 5.5.19. The CVE affected versions \u22645.1.1; the fix was released by upstream Spring team in version 5.1.2 (January 2019). Target version 5.5.19 inherits the fix from upstream release. All XML parsing delegates to Spring WS 3.1.6's DocumentBuilderFactoryUtils.newInstance(), which provides XXE protection by default. No TuxCare-specific backport exists for this CVE\u2014the protection shipped with the upstream 5.5.19 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.19; >= 5.0.0, < 5.0.11; >= 5.1.0, < 5.1.2; < 4.3.19; >= 5.0.0, < 5.0.11; >= 5.1.0, < 5.1.2), NVD (<= 4.3.18; >= 5.0.0, <= 5.0.10; >= 5.1.0, <= 5.1.1), cve.org (>= 5.0, < 5.0.10.RELEASE; >= 5.1, < 5.1.1.RELEASE; >= 4.3, < 4.3.18.RELEASE), Snyk (>= 5.1.0.RELEASE, < 5.1.2.RELEASE; >= 5.0.0.RELEASE, < 5.0.11.RELEASE; < 4.3.19.RELEASE; >= 5.1.0.RELEASE, < 5.1.2.RELEASE; >= 5.0.0.RELEASE, < 5.0.11.RELEASE; < 4.3.19.RELEASE).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.integration/spring-integration-xml@5.5.19-tuxcare.2"
    }
  ]
}