{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:8e4cb4fc-d233-509b-bf8a-18c4d4e4290c",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@5.2.7.RELEASE-tuxcare.5",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@5.2.7.RELEASE-tuxcare.5",
      "version": "5.2.7.RELEASE-tuxcare.5",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@5.2.7.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "5.2.7.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.2.7.RELEASE-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:ba3657a0-6b94-53af-b8b9-12e74ce7e063",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 5.2.7.RELEASE-tuxcare.5 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-4152 (XXE in Spring OXM JAXB marshaller) is NOT present in the target. The upstream fix from Spring Framework 3.2.4 (commit 7576274874, Aug 2013) was already included in the 5.2.7.RELEASE that TuxCare onboarded. The current code uses StaxUtils.createDefensiveInputFactory() which provides comprehensive XXE protection by disabling DTD support, external entity resolution, and using a no-o...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.2.7.RELEASE-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:3ebd12f9-3791-5d13-a18c-f51cce700f48",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 5.2.7.RELEASE-tuxcare.5 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-7315 affects Spring Framework before 3.2.4. The target version 5.2.7.RELEASE contains comprehensive XXE protections via StaxUtils.createDefensiveInputFactory() that were already present in the upstream release when TuxCare onboarded it. The vulnerable pattern (unprotected XMLInputFactory) is not present.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@5.2.7.RELEASE-tuxcare.5"
    }
  ]
}