{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:3a3d93b2-54b1-5bbf-951d-d02d603765d7",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.4",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.4",
      "version": "5.2.8.RELEASE-tuxcare.4",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "5.2.8.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:a37b90a9-d422-58a9-b760-6f81417cb0ba",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 5.2.8.RELEASE-tuxcare.4 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-4152 (XXE in Spring OXM JAXB marshaller) is NOT present in Spring Framework 5.2.8.RELEASE. The vulnerable pattern was removed by upstream Spring developers before the 5.2.8.RELEASE was published. The target uses StaxUtils.createDefensiveInputFactory() which disables DTD processing (SUPPORT_DTD=false), external entities (IS_SUPPORTING_EXTERNAL_ENTITIES=false), and provides a NO_OP_XML_R...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:f759a964-7c1b-5d30-b21a-bb2e8f5818d8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 5.2.8.RELEASE-tuxcare.4 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-7315 XXE vulnerability is not present in Spring Framework 5.2.8.RELEASE. The upstream vendor fix (commit 7576274874 from Aug 2013 by Arjen Poutsma) was already included in the upstream release before TuxCare onboarded it. The target uses StaxUtils.createDefensiveInputFactory() which provides comprehensive XXE protection by disabling DTD support, external entity resolution, and setting ...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.4"
    }
  ]
}