{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:6116d0da-49d1-5aa1-b093-cca17b666f94",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@5.3.24-tuxcare.10",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@5.3.24-tuxcare.10",
      "version": "5.3.24-tuxcare.10",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@5.3.24",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.24"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.24-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:082dc6de-484f-594c-937d-31a33aaf430d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 5.3.24-tuxcare.10 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-4152 (XXE vulnerability in Spring OXM JAXB marshaller) is NOT present in Spring Framework 5.3.24. The target uses StaxUtils.createDefensiveInputFactory() which provides comprehensive XXE protection by disabling DTD support, external entities, and using a no-op XML resolver. This fix was implemented upstream by Spring Framework developers in 2017 (commit e4651d6b50c by Juergen Hoeller) ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.24-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:9f1c56bf-9824-5724-8105-564092d32b4e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 5.3.24-tuxcare.10 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-7315 is NOT present in Spring Framework 5.3.24. The XXE vulnerability in Jaxb2CollectionHttpMessageConverter was fixed in the upstream release (commit 7576274 from August 2013, first appearing in v4.0.0.M3). The target version 5.3.24 was released in 2021 and already includes this fix. The current implementation uses StaxUtils.createDefensiveInputFactory() which provides comprehensive X...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@5.3.24-tuxcare.10"
    }
  ]
}