{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:98d3dc6d-740c-54a1-abbe-f329c6e07110",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@5.2.0.RELEASE-tuxcare.10",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@5.2.0.RELEASE-tuxcare.10",
      "version": "5.2.0.RELEASE-tuxcare.10",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@5.2.0.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "5.2.0.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.2.0.RELEASE-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:a5ba14e2-35ff-579f-b7d1-85a4afa3cbed",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 5.2.0.RELEASE-tuxcare.10 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-4152 affects Spring Framework's XML processing with JAXB marshaller when entity resolution is not disabled. The target version 5.2.0.RELEASE contains comprehensive XXE protections that were introduced in the upstream release before TuxCare maintenance began. The original fix (commit 7576274874, Aug 2013) added IS_REPLACING_ENTITY_REFERENCES=false. This was later enhanced and refactored...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.2.0.RELEASE-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:b5676b9d-04ff-5157-aabb-b1728392da61",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 5.2.0.RELEASE-tuxcare.10 of org.springframework:spring-oxm. not_affected \u2014 The target Spring Framework 5.2.0.RELEASE is not affected by CVE-2013-7315. The upstream fix for this XXE vulnerability (commit 7576274874deeccb6da6b09a8d5bd62e8b5538b7, authored by Arjen Poutsma on Aug 6, 2013) was already included in the upstream release that TuxCare onboarded. The vulnerable code pattern (bare XMLInputFactory.newInstance() without XXE protection) is not present in the target...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@5.2.0.RELEASE-tuxcare.10"
    }
  ]
}