{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:cbaf64de-5d04-59da-9ce6-097aa4b819a6",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@5.0.19.RELEASE-tuxcare.1",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@5.0.19.RELEASE-tuxcare.1",
      "version": "5.0.19.RELEASE-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@5.0.19.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "5.0.19.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.0.19.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9b78cb15-015a-557b-b179-fe2e0551badc",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-4152 (XXE vulnerability in Spring OXM JAXB marshaller) is not present in Spring Framework 5.0.19.RELEASE. The upstream fix was already included in version 5.0.19.RELEASE when TuxCare onboarded it. The code uses StaxUtils.createDefensiveInputFactory() which provides comprehensive XXE protection by disabling DTD support, external entities, and using a no-op XML resolver. The original fix...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.0.19.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9f24a33c-5c12-5e30-b336-66542d483c45",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 5.0.19.RELEASE-tuxcare.1 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-7315 affects Spring Framework versions before 3.2.4 and 4.0.0.M1-M2. The target version 5.0.19.RELEASE contains upstream fixes (commits 7576274874 and e4651d6b50) that disable external entity resolution in XMLInputFactory. The vulnerable code pattern is not present - the fix was already included in the upstream 5.0.19.RELEASE before TuxCare onboarding.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@5.0.19.RELEASE-tuxcare.1"
    }
  ]
}