{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:4de37458-3600-5948-8f3d-3af200b0e23a",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@5.1.6.RELEASE-tuxcare.5",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@5.1.6.RELEASE-tuxcare.5",
      "version": "5.1.6.RELEASE-tuxcare.5",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@5.1.6.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "5.1.6.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.1.6.RELEASE-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:f2536339-9c1f-5607-9b26-b9fcbd9ba164",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 5.1.6.RELEASE-tuxcare.5 of org.springframework:spring-oxm. not_affected \u2014 The target Spring Framework 5.1.6.RELEASE is not affected by CVE-2013-4152. The XXE vulnerability fix was already present in the upstream 5.1.6.RELEASE version when TuxCare onboarded it. The fix commit (7576274874) from August 2013 by Arjen Poutsma disabled entity reference replacement in Jaxb2CollectionHttpMessageConverter. The current code has an even more comprehensive defense via StaxUtils....",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.1.6.RELEASE-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:32870e18-945c-59b8-a42e-2a4ebaef8376",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 5.1.6.RELEASE-tuxcare.5 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-7315 describes an XXE vulnerability in Spring Framework's Jaxb2CollectionHttpMessageConverter where XMLInputFactory did not disable external entity resolution, allowing attackers to read arbitrary files. The target version (5.1.6.RELEASE) is NOT AFFECTED because the upstream fix (commit 7576274874 from August 2013 by Arjen Poutsma) was already present in the Spring Framework release th...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@5.1.6.RELEASE-tuxcare.5"
    }
  ]
}