{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:eed94e2d-33b9-50ea-86b2-d10b57db0d95",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@5.1.18.RELEASE-tuxcare.4",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@5.1.18.RELEASE-tuxcare.4",
      "version": "5.1.18.RELEASE-tuxcare.4",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@5.1.18.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "5.1.18.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.1.18.RELEASE-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:6f974ac8-8e9b-5599-94c0-75e6b90fa841",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 5.1.18.RELEASE-tuxcare.4 of org.springframework:spring-oxm. not_affected \u2014 The target Spring Framework 5.1.18.RELEASE is NOT vulnerable to CVE-2013-4152. The XXE vulnerability in the JAXB marshaller was fixed in the upstream release before TuxCare onboarded this version. The vulnerable code pattern (XMLInputFactory.newInstance() without security configuration) is not present; instead, the code uses StaxUtils.createDefensiveInputFactory() which provides comprehensive X...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.1.18.RELEASE-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:7cf317d6-ac0d-5564-b67f-365d40afb4f9",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 5.1.18.RELEASE-tuxcare.4 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-7315 affects Spring Framework before 3.2.4 and 4.0.0.M1-M2 due to XXE vulnerability in StAX XMLInputFactory. Target version 5.1.18.RELEASE is NOT vulnerable because comprehensive XXE defenses were introduced by upstream Spring Framework (commits e4651d6b50c and 673a20cb10f) and were already present in the 5.1.18.RELEASE when TuxCare onboarded it. All production code paths that create X...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@5.1.18.RELEASE-tuxcare.4"
    }
  ]
}