{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:a108f6d1-5ef0-521d-bdf0-3ad8eae608c5",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@5.3.32-tuxcare.4",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@5.3.32-tuxcare.4",
      "version": "5.3.32-tuxcare.4",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@5.3.32",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.32"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.32-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:d6ca10a3-6874-5ddf-a026-57c6c2782dde",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 5.3.32-tuxcare.4 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-4152 XXE vulnerability is NOT present in Spring Framework 5.3.32. The comprehensive XXE protection via StaxUtils.createDefensiveInputFactory() and secure-by-default configurations in all XML converters (Jaxb2CollectionHttpMessageConverter, SourceHttpMessageConverter, Jaxb2Marshaller) was already included in the upstream Spring Framework 5.3.32 release when TuxCare onboarded it. The ori...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.32-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:d3c1e225-2b46-5b49-b138-bd948230bf26",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 5.3.32-tuxcare.4 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-7315 XXE vulnerability is not present in Spring Framework 5.3.32. The upstream vendor fixed this issue in 2013 (commit 7576274874) by disabling entity reference replacement in XMLInputFactory, and further strengthened protections in 2017 (commit e4651d6b50) by introducing StaxUtils.createDefensiveInputFactory() which disables DTD support, external entities, and provides a no-op resolve...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@5.3.32-tuxcare.4"
    }
  ]
}