{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:60724a97-a7bd-5a37-8ecc-530f27040565",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@4.3.16.RELEASE-tuxcare.2",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@4.3.16.RELEASE-tuxcare.2",
      "version": "4.3.16.RELEASE-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@4.3.16.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "4.3.16.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@4.3.16.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:693883a8-1ed1-5ab9-8a18-14de75264115",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 4.3.16.RELEASE-tuxcare.2 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-4152 (XXE vulnerability in Spring OXM JAXB marshaller) is not present in Spring Framework 4.3.16.RELEASE. The upstream vendor (Spring/Pivotal) fixed this vulnerability in August 2013 (commit 7576274874d, SPR-10806), and the fix was included in the 4.3.16.RELEASE that TuxCare onboarded. The current code contains comprehensive XXE protections: XMLInputFactory is configured with SUPPORT_D...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@4.3.16.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ca9ed789-e420-5f4a-aa40-d6b0d126240a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 4.3.16.RELEASE-tuxcare.2 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-7315 is an XXE vulnerability in Spring MVC's Jaxb2CollectionHttpMessageConverter where external entity resolution was not disabled in StAX XMLInputFactory. The target Spring Framework 4.3.16.RELEASE is NOT affected because the upstream fix was already present in this release when TuxCare onboarded it. The code contains comprehensive XXE protections (disables DTD, external entities, and...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@4.3.16.RELEASE-tuxcare.2"
    }
  ]
}