{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:357bd795-6f14-5aef-877e-255839231c2d",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11",
      "version": "5.3.29-tuxcare.11",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@5.3.29",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.29"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:22c72f24-8078-5f36-a7c5-6173cc3e3f82",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 5.3.29-tuxcare.11 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-4152 (XXE vulnerability in Spring OXM JAXB marshaller) is NOT present in spring-framework 5.3.29-tuxcare.12. The fix was already included in the upstream Spring Framework 5.3.29 release before TuxCare onboarded it. The target uses StaxUtils.createDefensiveInputFactory() which disables DTD and external entity processing, providing comprehensive XXE protection that exceeds the original p...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:e1f848ef-8def-50d4-a8ad-31c9e9684ae0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 5.3.29-tuxcare.11 of org.springframework:spring-oxm. not_affected \u2014 Spring Framework 5.3.29 is NOT affected by CVE-2013-7315 (XXE vulnerability in Jaxb2CollectionHttpMessageConverter). The vulnerable code pattern (unprotected XMLInputFactory.newInstance()) is not present in the target. The fix was applied by upstream Spring Framework in August 2013 (commit 7576274874 by Arjen Poutsma) and was already included in the upstream release 5.3.29 that TuxCare onboarde...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@5.3.29-tuxcare.11"
    }
  ]
}