{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:1659fd23-8130-5bab-857d-780ab1566028",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.11",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.11",
      "version": "6.0.23-tuxcare.11",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@6.0.23",
            "type": "library",
            "group": "org.springframework",
            "version": "6.0.23"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:1bef1716-4400-5aa3-a2bf-b35a9e5e1155",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 6.0.23-tuxcare.11 of org.springframework:spring-oxm. not_affected \u2014 Spring Framework 6.0.23-tuxcare.12 is not affected by CVE-2013-4152 (XXE vulnerability in Spring OXM JAXB marshaller). The vulnerable pattern is not present because comprehensive XXE defenses were included in the upstream release that TuxCare onboarded. All XML processing components use defensive configurations that disable DTD support, external entity resolution, and set no-op entity resolvers.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:a3166655-f2de-5a2b-8b3c-69c4e2c969c9",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 6.0.23-tuxcare.11 of org.springframework:spring-oxm. not_affected \u2014 Target Spring Framework 6.0.23 is not affected by CVE-2013-7315. The vulnerable pattern (unprotected XMLInputFactory allowing external entity resolution) is not present. The target uses StaxUtils.createDefensiveInputFactory() which sets SUPPORT_DTD=false, IS_SUPPORTING_EXTERNAL_ENTITIES=false, and NO_OP_XML_RESOLVER, providing comprehensive XXE protection. This fix was authored by upstream Spri...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@6.0.23-tuxcare.11"
    }
  ]
}