{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:2fcd6927-d322-5e28-8751-b42c120a8774",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@6.0.15-tuxcare.5",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@6.0.15-tuxcare.5",
      "version": "6.0.15-tuxcare.5",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@6.0.15",
            "type": "library",
            "group": "org.springframework",
            "version": "6.0.15"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@6.0.15-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:2c280c88-1a2e-5957-b11e-2ffef0875a7d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 6.0.15-tuxcare.5 of org.springframework:spring-oxm. not_affected \u2014 Target Spring Framework 6.0.15 is NOT affected by CVE-2013-4152. The XXE vulnerability was fixed in upstream commit 7576274874 (Aug 2013) which set IS_REPLACING_ENTITY_REFERENCES=false, then enhanced with comprehensive protections (SUPPORT_DTD=false, IS_SUPPORTING_EXTERNAL_ENTITIES=false, NO_OP_XML_RESOLVER) in 2015, and refactored to StaxUtils.createDefensiveInputFactory() in 2017 (commit e465...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@6.0.15-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:24be1585-867c-54e5-9a2e-dd78e3aaa0a1",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 6.0.15-tuxcare.5 of org.springframework:spring-oxm. not_affected \u2014 Spring Framework 6.0.15 is not affected by CVE-2013-7315 (XXE vulnerability in Spring MVC's StAX XMLInputFactory). The vulnerability was fixed in upstream commit 7576274874 (Aug 2013) which was already present in the 6.0.15 release before TuxCare onboarded it. The current implementation uses StaxUtils.createDefensiveInputFactory() which provides even stronger protection than the original fix by...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@6.0.15-tuxcare.5"
    }
  ]
}