{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:a2edf21e-8024-5b9b-9dc9-b24acb279d05",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@6.1.7-tuxcare.6",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@6.1.7-tuxcare.6",
      "version": "6.1.7-tuxcare.6",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@6.1.7",
            "type": "library",
            "group": "org.springframework",
            "version": "6.1.7"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@6.1.7-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:767b7e75-ec4b-52bf-a7d0-8c9c34b2be19",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 6.1.7-tuxcare.6 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-4152 XXE vulnerability NOT PRESENT in Spring Framework 6.1.7-tuxcare.8. The upstream vendor fix (commit 7576274874) was already shipped in the upstream release 6.1.7 before TuxCare onboarded it. The current implementation uses StaxUtils.createDefensiveInputFactory() which disables DTD support, external entity processing, and uses a no-op XMLResolver - providing comprehensive protection...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@6.1.7-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:b4033803-7ce2-5534-8a2b-974cc630252c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 6.1.7-tuxcare.6 of org.springframework:spring-oxm. not_affected \u2014 Spring Framework 6.1.7 is not affected by CVE-2013-7315 (XXE in Jaxb2CollectionHttpMessageConverter). The vulnerable pattern (unprotected XMLInputFactory.newInstance()) is absent. The target uses StaxUtils.createDefensiveInputFactory() which comprehensively blocks XXE by disabling DTD support, external entities, and using a no-op XML resolver. This defensive approach was introduced by upstream ...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@6.1.7-tuxcare.6"
    }
  ]
}