{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:e6178f93-482f-59f9-93c8-20f4b2b41ae4",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-integration-zip",
      "purl": "pkg:maven/org.springframework.integration/spring-integration-zip@6.3.11-tuxcare.6",
      "type": "library",
      "group": "org.springframework.integration",
      "bom-ref": "pkg:maven/org.springframework.integration/spring-integration-zip@6.3.11-tuxcare.6",
      "version": "6.3.11-tuxcare.6",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-integration-zip",
            "purl": "pkg:maven/org.springframework.integration/spring-integration-zip@6.3.11",
            "type": "library",
            "group": "org.springframework.integration",
            "version": "6.3.11"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1261",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-zip@6.3.11-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:7513b9fe-69dd-5475-9d26-4b09e1e668c5",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1261 does not affect version 6.3.11-tuxcare.6 of org.springframework.integration:spring-integration-zip. not_affected \u2014 CVE-2018-1261 describes a path traversal vulnerability in spring-integration-zip where malicious archives with traversal filenames (e.g., \"../../etc/passwd\") can write files outside the intended extraction directory. The target repository (Spring Integration 6.3.11-tuxcare.6) is NOT AFFECTED because the upstream release already contains the fix. The UnZipTransformer.java file implements canonic...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1263",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-zip@6.3.11-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:70cad41a-450c-5216-b708-790f65ce3a05",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1263 does not affect version 6.3.11-tuxcare.6 of org.springframework.integration:spring-integration-zip. not_affected \u2014 CVE-2018-1263 describes a path traversal vulnerability in spring-integration-zip where specially crafted archive entries with path traversal sequences (e.g., \"../../../etc/passwd\") could write files outside the intended extraction directory. The target repository (Spring Integration 6.3.11-tuxcare.6) is NOT AFFECTED because the fix was already present in the upstream release that TuxCare onboar...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-22114",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-zip@6.3.11-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:8883d2c4-929c-5c28-9ea0-e54196d1e254",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-22114 does not affect version 6.3.11-tuxcare.6 of org.springframework.integration:spring-integration-zip. not_affected \u2014 CVE-2021-22114 addresses path traversal vulnerabilities in spring-integration-zip. The target repository (spring-integration 6.3.11-tuxcare.6) is NOT AFFECTED because the path traversal protection was already present in the upstream release that TuxCare onboarded. The fix (checkPath method in UnZipTransformer.java) was committed by upstream Spring developer Artem Bilan on 2023-02-16, well befor...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47862",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-zip@6.3.11-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:f8abd9ad-9a0f-5603-8e0a-561029fce879",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47862 is fixed in version 6.3.11-tuxcare.6 of org.springframework.integration:spring-integration-zip."
      }
    },
    {
      "id": "CVE-2026-59274",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-zip@6.3.11-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:876b717e-8cee-5fb4-9d47-3037af19e041",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59274 is fixed in version 6.3.11-tuxcare.6 of org.springframework.integration:spring-integration-zip."
      }
    },
    {
      "id": "CVE-2026-59311",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-zip@6.3.11-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:0c0ce513-cc2f-5342-a10c-5f6a9af6db49",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59311 is fixed in version 6.3.11-tuxcare.6 of org.springframework.integration:spring-integration-zip."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.integration/spring-integration-zip@6.3.11-tuxcare.6"
    }
  ]
}