{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:2418913a-a5f3-5c51-b9c8-1043d13a8fee",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@6.1.4-tuxcare.8",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@6.1.4-tuxcare.8",
      "version": "6.1.4-tuxcare.8",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@6.1.4",
            "type": "library",
            "group": "org.springframework",
            "version": "6.1.4"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@6.1.4-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:006d47cb-bfd9-5d0c-8aa2-a5ba26cf2f28",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 6.1.4-tuxcare.8 of org.springframework:spring-oxm. not_affected \u2014 Spring Framework 6.1.4 is not affected by CVE-2013-4152 (XXE in Spring OXM JAXB marshaller). The upstream fix was implemented in 2013 and shipped in the release. The current code uses StaxUtils.createDefensiveInputFactory() which provides comprehensive XXE protection by disabling DTD support, external entities, and setting a no-op XML resolver. The vulnerable pattern (unprotected XMLInputFactor...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@6.1.4-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:62901e60-5f8d-5efd-96a9-e18c096b8d01",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 6.1.4-tuxcare.8 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-7315 XXE vulnerability is NOT present in Spring Framework 6.1.4. The target uses StaxUtils.createDefensiveInputFactory() which provides comprehensive XXE protection (disables DTD, external entities, and sets no-op resolver). This fix was introduced by upstream Spring in 2017 (commit e4651d6b) and was already present in the 6.1.4 release when TuxCare onboarded it. The defense is more ro...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@6.1.4-tuxcare.8"
    }
  ]
}