{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:4dcb24b5-5621-534a-ac6a-ec63b0ed5fcb",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@5.2.17.RELEASE-tuxcare.1",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@5.2.17.RELEASE-tuxcare.1",
      "version": "5.2.17.RELEASE-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@5.2.17.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "5.2.17.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.2.17.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8800f209-9ab9-532b-8e5b-edf87f72c74d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 5.2.17.RELEASE-tuxcare.1 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-4152 (XXE vulnerability in Spring OXM/JAXB marshaller) is NOT present in Spring Framework 5.2.17.RELEASE-tuxcare.3. The upstream fix (commit 7576274874) was applied by Spring developers in August 2013 and was already included in the 5.2.17.RELEASE version before TuxCare onboarded it. The target code uses StaxUtils.createDefensiveInputFactory() which comprehensively blocks XXE attacks b...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.2.17.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:65eca990-aa7a-5af4-b3b4-3766d0fc15fa",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 5.2.17.RELEASE-tuxcare.1 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-7315 (XXE in Spring MVC XMLInputFactory) is NOT present in target Spring Framework 5.2.17.RELEASE-tuxcare.3. The vulnerable code pattern (unprotected XMLInputFactory.newInstance()) was removed by upstream Spring and replaced with StaxUtils.createDefensiveInputFactory(), which provides comprehensive XXE protection by disabling DTD support, external entities, and setting a no-op XML reso...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@5.2.17.RELEASE-tuxcare.1"
    }
  ]
}