{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:310a7096-1ca2-5cfc-9d3f-0d3baa008ec0",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-integration-zip",
      "purl": "pkg:maven/org.springframework.integration/spring-integration-zip@6.4.10-tuxcare.8",
      "type": "library",
      "group": "org.springframework.integration",
      "bom-ref": "pkg:maven/org.springframework.integration/spring-integration-zip@6.4.10-tuxcare.8",
      "version": "6.4.10-tuxcare.8",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-integration-zip",
            "purl": "pkg:maven/org.springframework.integration/spring-integration-zip@6.4.10",
            "type": "library",
            "group": "org.springframework.integration",
            "version": "6.4.10"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1261",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-zip@6.4.10-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:1ee836bb-1cfd-57f0-a5d7-cd3cecb809a0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1261 does not affect version 6.4.10-tuxcare.8 of org.springframework.integration:spring-integration-zip. not_affected \u2014 CVE-2018-1261 path traversal vulnerability is NOT present in spring-integration 6.4.10. The vulnerable code pattern was already removed by an upstream fix (commit 210a2f9d2c by abilan@vmware.com) that shipped in Spring Integration 6.1.0 and all subsequent versions. The fix validates archive entry paths using canonical path comparison to prevent directory traversal before file extraction.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1263",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-zip@6.4.10-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:de4e7276-7a7a-5b5b-989e-e03bbf86597e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1263 does not affect version 6.4.10-tuxcare.8 of org.springframework.integration:spring-integration-zip. not_affected \u2014 CVE-2018-1263 (path traversal in zip archive extraction) is not present in Spring Integration 6.4.10. The upstream vendor (Spring/VMware) fixed this vulnerability when spring-integration-zip was migrated as a core module. The fix (commit 210a2f9d2c9) includes a checkPath() method that validates zip entry names using canonical path resolution to prevent files from being extracted outside the tar...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-22114",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-zip@6.4.10-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:5b1741c3-02cd-5ffe-aa2a-61156696c859",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-22114 does not affect version 6.4.10-tuxcare.8 of org.springframework.integration:spring-integration-zip. not_affected \u2014 CVE-2021-22114 path traversal vulnerability is not present in spring-integration 6.4.10-tuxcare.9. The UnZipTransformer.checkPath() method validates that all extracted archive entries remain within the target directory by comparing canonical paths before any file operations occur. This defense was introduced in upstream commit 210a2f9d2c (Feb 2023) by Artem Bilan (abilan@vmware.com) and was pre...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47862",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-zip@6.4.10-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:304838ca-b039-51d0-ad78-746129817c10",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47862 is fixed in version 6.4.10-tuxcare.8 of org.springframework.integration:spring-integration-zip."
      }
    },
    {
      "id": "CVE-2026-59274",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-zip@6.4.10-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:4e5e7fe3-5eab-5e09-bb16-b0dd6aae862c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59274 is fixed in version 6.4.10-tuxcare.8 of org.springframework.integration:spring-integration-zip."
      }
    },
    {
      "id": "CVE-2026-59311",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-zip@6.4.10-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:e8cabae8-795f-5716-9dda-aeff45185f57",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59311 is fixed in version 6.4.10-tuxcare.8 of org.springframework.integration:spring-integration-zip."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.integration/spring-integration-zip@6.4.10-tuxcare.8"
    }
  ]
}