{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:6ed241ec-0791-5a2b-a7bc-e94355785ebe",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@4.3.30.RELEASE-tuxcare.10",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@4.3.30.RELEASE-tuxcare.10",
      "version": "4.3.30.RELEASE-tuxcare.10",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@4.3.30.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "4.3.30.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@4.3.30.RELEASE-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:74a4bfda-5263-5598-ae5f-3a57da6d3f5d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-oxm. not_affected \u2014 Spring Framework 4.3.30.RELEASE is NOT VULNERABLE to CVE-2013-4152 (XXE via JAXB marshaller). The vulnerability was fixed by upstream commit 7576274874 (Arjen Poutsma, Aug 2013) which shipped in the 4.3.30.RELEASE that TuxCare onboarded. The current code has comprehensive XXE protections: SUPPORT_DTD=false, IS_SUPPORTING_EXTERNAL_ENTITIES=false, and NO_OP_XML_RESOLVER. These defenses are MORE C...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@4.3.30.RELEASE-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:596c7706-6216-52c3-8d9f-99e8824f540b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-7315 XXE vulnerability is not present in Spring Framework 4.3.30.RELEASE. The upstream vendor (Spring) fixed this vulnerability in August 2013 (commit 7576274874) and enhanced the fix with additional XXE protections through 2015. All fixes were part of upstream v4.3.30.RELEASE (released December 2020) before TuxCare onboarded it in August 2025. The current code has comprehensive XXE pr...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@4.3.30.RELEASE-tuxcare.10"
    }
  ]
}