{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:a5ecfff6-8149-56c7-b5d3-0c6fe32797d3",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@5.3.15-tuxcare.4",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@5.3.15-tuxcare.4",
      "version": "5.3.15-tuxcare.4",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@5.3.15",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.15"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.15-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:08d69ba5-b1e0-5467-aa5c-5873d0601736",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 5.3.15-tuxcare.4 of org.springframework:spring-oxm. not_affected \u2014 The target Spring Framework 5.3.15 is not affected by CVE-2013-4152. The XXE vulnerability was fixed in the upstream release before TuxCare's involvement. The vulnerable code pattern (unprotected XMLInputFactory creation allowing external entity resolution) is not present. The target uses StaxUtils.createDefensiveInputFactory() which disables DTD support, disables external entity resolution, an...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.15-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:c9884c60-3a4b-5182-a1a3-f90f773fbc0d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 5.3.15-tuxcare.4 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-7315 is not present in Spring Framework 5.3.15. The upstream fix (commit 7576274874 by apoutsma@gopivotal.com) that disables external entity resolution in XMLInputFactory was already included in the upstream release before TuxCare onboarded it. The current code uses an enhanced version of the fix via StaxUtils.createDefensiveInputFactory(), which provides stronger protection by disabli...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@5.3.15-tuxcare.4"
    }
  ]
}