{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:927e4ede-7a4d-5b72-aade-18680149f9be",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@5.2.25.RELEASE-tuxcare.1",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@5.2.25.RELEASE-tuxcare.1",
      "version": "5.2.25.RELEASE-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@5.2.25.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "5.2.25.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.2.25.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d32467e4-be52-5326-918a-3525609a7f3c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 5.2.25.RELEASE-tuxcare.1 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-4152 (XXE in Spring OXM JAXB marshaller) is NOT present in Spring Framework 5.2.25.RELEASE. The upstream fix by Arjen Poutsma (commit 7576274874, Aug 2013) was already included in the upstream release before TuxCare onboarding. The target code uses StaxUtils.createDefensiveInputFactory() which provides comprehensive XXE protection via three defensive layers: SUPPORT_DTD=false, IS_SUPPO...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.2.25.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0d529a25-2b1a-5a2f-a51b-5b659f3839e9",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 5.2.25.RELEASE-tuxcare.1 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-7315 is NOT present in Spring Framework 5.2.25.RELEASE. The vulnerable pattern (unprotected XMLInputFactory allowing external entity resolution) does not exist in the target. The upstream Spring Framework shipped with StaxUtils.createDefensiveInputFactory() which sets IS_SUPPORTING_EXTERNAL_ENTITIES=false, providing comprehensive XXE protection that is stronger than the original CVE pa...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@5.2.25.RELEASE-tuxcare.1"
    }
  ]
}