{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:bdd7494f-fe43-5fd5-a2bb-007879b5279f",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@5.1.3.RELEASE-tuxcare.1",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@5.1.3.RELEASE-tuxcare.1",
      "version": "5.1.3.RELEASE-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@5.1.3.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "5.1.3.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.1.3.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:de71356a-ad43-59c9-abb3-c70eaece0957",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 5.1.3.RELEASE-tuxcare.1 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-4152 affects Spring Framework versions before 3.2.4 and 4.0.0.M1. The target version 5.1.3.RELEASE (released December 2018) shipped with comprehensive XXE protections already in place. The Jaxb2CollectionHttpMessageConverter uses StaxUtils.createDefensiveInputFactory() which disables DTD support, external entities, and sets a no-op XML resolver. This defensive factory was introduced by...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.1.3.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:01d2f4d6-0d3c-536b-b2be-5d8278cd5b14",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 5.1.3.RELEASE-tuxcare.1 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-7315 describes an XXE vulnerability in Spring MVC's StAX XMLInputFactory where external entity resolution was not disabled. The target Spring Framework 5.1.3.RELEASE is not affected because the upstream vendor (Pivotal/Spring) fixed this vulnerability in Spring 5.0 (2017) by introducing StaxUtils.createDefensiveInputFactory(), which comprehensively disables DTD support, external entiti...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@5.1.3.RELEASE-tuxcare.1"
    }
  ]
}