{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:0004beb7-ad05-53e4-aa6c-66a2d37e7322",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@5.3.19-tuxcare.1",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@5.3.19-tuxcare.1",
      "version": "5.3.19-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@5.3.19",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.19"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.19-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9e095ac1-216b-59b1-b1d3-3b367eff27dd",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 5.3.19-tuxcare.1 of org.springframework:spring-oxm. not_affected \u2014 Spring Framework 5.3.19 is NOT affected by CVE-2013-4152 (XXE vulnerability in Spring OXM JAXB marshaller). The vulnerable pattern identified in the CVE (XMLInputFactory without XXE protections) is not present in the target. The upstream Spring Framework introduced a comprehensive fix in Spring 5.0 via StaxUtils.createDefensiveInputFactory(), which provides MORE robust XXE protection than the o...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.19-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:1d8cacf8-d555-5ee8-b1f6-7671acffdad2",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 5.3.19-tuxcare.1 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-7315 (XXE in Spring MVC's Jaxb2CollectionHttpMessageConverter) is NOT present in target version 5.3.19. The upstream fix was applied in August 2013 (commit 7576274874) and shipped in the Spring Framework upstream release. The target uses StaxUtils.createDefensiveInputFactory() which disables DTDs, external entities, and sets a no-op resolver - providing even stronger protection than th...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@5.3.19-tuxcare.1"
    }
  ]
}