{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:9b8b3ef6-78cd-5fa1-b78f-279be193347f",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@5.3.33-tuxcare.1",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@5.3.33-tuxcare.1",
      "version": "5.3.33-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@5.3.33",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.33"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:4917218f-cd59-57f8-aaea-39fca7117310",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 5.3.33-tuxcare.1 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-4152 is not present in Spring Framework 5.3.33. The upstream Spring Framework team introduced a comprehensive XXE protection fix in May 2014 (commit 8e096aef), well before this version. The target uses StaxUtils.createDefensiveInputFactory() which disables DTD support, external entity resolution, and sets a no-op XML resolver - providing even stronger protection than the original CVE p...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:1c7fe440-fcaf-54e8-8159-fd20591b020c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 5.3.33-tuxcare.1 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-7315 describes an XXE vulnerability in Spring Framework's Jaxb2CollectionHttpMessageConverter where XMLInputFactory was created without disabling external entity resolution. The target repository (Spring Framework 5.3.33) is not affected because the vulnerable code pattern is not present. The target uses StaxUtils.createDefensiveInputFactory() which provides comprehensive XXE protectio...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@5.3.33-tuxcare.1"
    }
  ]
}