{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:07eec789-1454-5163-8904-b3151ebc97f0",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@6.1.14-tuxcare.2",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@6.1.14-tuxcare.2",
      "version": "6.1.14-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@6.1.14",
            "type": "library",
            "group": "org.springframework",
            "version": "6.1.14"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@6.1.14-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:32557ea1-75f8-5d64-b1ef-8c3703d5d0ff",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 6.1.14-tuxcare.2 of org.springframework:spring-oxm. not_affected \u2014 Target is not affected by CVE-2013-4152. The original XXE vulnerability fix (commit 7576274874, August 6, 2013) was authored by Arjen Poutsma (apoutsma@gopivotal.com) from the upstream Spring Framework team and shipped in the upstream release before any TuxCare modifications. The target uses an enhanced version of the fix via StaxUtils.createDefensiveInputFactory(), which provides stronger XXE ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@6.1.14-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:d2a5f5f7-17ce-51b2-9f6d-6a5e87ed2af4",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 6.1.14-tuxcare.2 of org.springframework:spring-oxm. not_affected \u2014 The XXE vulnerability CVE-2013-7315 is not present in Spring Framework 6.1.14. The upstream fix (commit 7576274874) was already included in the Spring Framework 6.1.14 release before TuxCare onboarding. All XMLInputFactory instances in production code use defensive configurations that disable external entity resolution: Jaxb2CollectionHttpMessageConverter uses StaxUtils.createDefensiveInputFact...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@6.1.14-tuxcare.2"
    }
  ]
}