{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:41df7674-ea19-5ed7-ba69-d7c9a6fec0b9",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.14",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.14",
      "version": "4.2.9.RELEASE-tuxcare.14",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "4.2.9.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.14"
        }
      ],
      "bom-ref": "urn:uuid:bc6c0e79-fed7-54c4-aff0-8759aa8cda99",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 4.2.9.RELEASE-tuxcare.14 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-4152 XXE vulnerability is NOT present in Spring Framework 4.2.9.RELEASE-tuxcare.13. The vulnerability was fixed by upstream Spring Framework developers in multiple commits (7576274874, 8e096aeef5, d79ec68db4) that were included in the upstream 4.2.9.RELEASE before TuxCare onboarded it. The current code has comprehensive XXE protections: SUPPORT_DTD=false, IS_SUPPORTING_EXTERNAL_ENTITIE...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.14"
        }
      ],
      "bom-ref": "urn:uuid:7dfe39e0-f0fe-528c-8c79-f2580d925046",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 4.2.9.RELEASE-tuxcare.14 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-7315 is an XXE vulnerability in Spring Framework's Jaxb2CollectionHttpMessageConverter where XMLInputFactory did not disable external entity resolution. The target version 4.2.9.RELEASE-tuxcare.13 is NOT vulnerable because the upstream fix (commit 7576274874 by Arjen Poutsma, Aug 6 2013) was already present in Spring Framework 4.2.9.RELEASE when TuxCare onboarded it. The current code h...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@4.2.9.RELEASE-tuxcare.14"
    }
  ]
}