{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:d182ac4d-213c-596b-84c5-8f1cd5add7d3",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@5.2.9.RELEASE-tuxcare.5",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@5.2.9.RELEASE-tuxcare.5",
      "version": "5.2.9.RELEASE-tuxcare.5",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@5.2.9.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "5.2.9.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.2.9.RELEASE-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:3cf2645e-6974-56d9-8490-771f19bbc38d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 5.2.9.RELEASE-tuxcare.5 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-4152 (XXE vulnerability in Spring OXM JAXB marshaller) is NOT present in Spring Framework 5.2.9.RELEASE. The fix was already included in the upstream release before TuxCare onboarded it (commit 097b1afb26). All XML processing components (Jaxb2CollectionHttpMessageConverter, Jaxb2RootElementHttpMessageConverter, Jaxb2Marshaller, SourceHttpMessageConverter) use defensive configurations t...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.2.9.RELEASE-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:6c42a399-6602-50b8-94d1-2ee703c21926",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 5.2.9.RELEASE-tuxcare.5 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-7315 affects Spring Framework before 3.2.4. The target (5.2.9.RELEASE) is not affected because the vulnerable code pattern is not present. The original XXE fix was introduced by upstream Spring developers (commit 7576274874deeccb6da6b09a8d5bd62e8b5538b7, author apoutsma@gopivotal.com) and was already included in upstream 5.2.9.RELEASE when TuxCare onboarded it. The target uses StaxUtil...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@5.2.9.RELEASE-tuxcare.5"
    }
  ]
}