{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:d1d17a87-5a93-5ab2-8159-d2f446da3a1e",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@6.1.16-tuxcare.6",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@6.1.16-tuxcare.6",
      "version": "6.1.16-tuxcare.6",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@6.1.16",
            "type": "library",
            "group": "org.springframework",
            "version": "6.1.16"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@6.1.16-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:f7715778-42d8-59fb-b9d4-97ace4b38c67",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 6.1.16-tuxcare.6 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-4152 (XXE in Spring OXM JAXB marshaller) is NOT present in version 6.1.16. Comprehensive upstream fixes were already shipped in the upstream release when TuxCare onboarded this version. All JAXB/OXM components have XXE protections enabled by default: DTD support disabled, external entity resolution disabled, and NO_OP entity resolvers in place.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@6.1.16-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:c5b1b5be-0392-58c7-a7bc-c0bfd6a0bdca",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 6.1.16-tuxcare.6 of org.springframework:spring-oxm. not_affected \u2014 Spring Framework 6.1.16 is NOT affected by CVE-2013-7315 (XXE vulnerability in StAX XMLInputFactory). The target version uses comprehensive XXE protection via StaxUtils.createDefensiveInputFactory() that was introduced by upstream Spring maintainer Juergen Hoeller in 2017 (commit e4651d6b50c), years before version 6.1.16 was released. The defensive factory disables DTD support, external entitie...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@6.1.16-tuxcare.6"
    }
  ]
}