{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:5736fefa-fd80-5a41-8ce3-7922d75c4a96",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@5.1.13.RELEASE-tuxcare.4",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@5.1.13.RELEASE-tuxcare.4",
      "version": "5.1.13.RELEASE-tuxcare.4",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@5.1.13.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "5.1.13.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.1.13.RELEASE-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:f8c9cf67-7711-5db4-accd-f4742188b234",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 5.1.13.RELEASE-tuxcare.4 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-4152 (XXE in Spring OXM JAXB marshaller) is NOT present in target version 5.1.13.RELEASE. The vulnerable pattern was already fixed by upstream Spring Framework before TuxCare onboarded this version. The target uses StaxUtils.createDefensiveInputFactory() which comprehensively disables DTD support, external entities, and sets a no-op XML resolver - providing stronger protection than the...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.1.13.RELEASE-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:39f9eff7-bfc4-5e95-878d-e6bcd2d96c2f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 5.1.13.RELEASE-tuxcare.4 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-7315 affects Spring Framework before 3.2.4 and 4.0.0.M1-M2. The target version 5.1.13.RELEASE (from 2019) already contains comprehensive XXE protection that was included in the upstream release. The vulnerable pattern (creating XMLInputFactory without disabling external entities) is not present. The target uses StaxUtils.createDefensiveInputFactory() which disables DTD support, externa...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@5.1.13.RELEASE-tuxcare.4"
    }
  ]
}