{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:424d6561-54bb-5f35-a6dc-82f92d36326e",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@5.3.6-tuxcare.3",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@5.3.6-tuxcare.3",
      "version": "5.3.6-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@5.3.6",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.6"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.6-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:b463e403-423e-5d50-b0f8-f3be60128dbc",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 5.3.6-tuxcare.3 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-4152 affects Spring Framework versions before 3.2.4 and 4.0.0.M1. The target is Spring Framework 5.3.6-tuxcare.2, which already contains the upstream fix (commit 7576274874) that was included in the original 5.3.6 release. The current code uses StaxUtils.createDefensiveInputFactory() which provides comprehensive XXE protection by disabling DTD support, disabling external entities, and ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@5.3.6-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:aa5ef035-8a4b-5015-8d0f-1d30a0538dee",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 5.3.6-tuxcare.3 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-7315 is not present in Spring Framework 5.3.6. The XXE vulnerability in Jaxb2CollectionHttpMessageConverter was fixed by upstream in 2013 (commit 7576274874) and further hardened in 2017 (commit e4651d6b50). Both fix commits are ancestors of TuxCare's 5.3.6 onboarding commit, confirming the fix shipped in the upstream release. Current code uses StaxUtils.createDefensiveInputFactory() w...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@5.3.6-tuxcare.3"
    }
  ]
}