{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:a4e88156-d2aa-5821-a54f-3b194a899a65",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@6.2.1-tuxcare.6",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@6.2.1-tuxcare.6",
      "version": "6.2.1-tuxcare.6",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@6.2.1",
            "type": "library",
            "group": "org.springframework",
            "version": "6.2.1"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@6.2.1-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:d4547352-688b-5f3d-a279-654ce40093a2",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 6.2.1-tuxcare.6 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-4152 (XXE in Spring OXM/JAXB marshaller) is NOT present in Spring Framework 6.2.1-tuxcare.6. The target version already contains comprehensive XXE protections that were shipped in the upstream 6.2.1 release. Both Jaxb2CollectionHttpMessageConverter and Jaxb2Marshaller have multiple layers of defense: XMLInputFactory configured with SUPPORT_DTD=false, IS_SUPPORTING_EXTERNAL_ENTITIES=fal...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@6.2.1-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:8be09b0c-93a4-5c40-9ef4-36e5cc9f780b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 6.2.1-tuxcare.6 of org.springframework:spring-oxm. not_affected \u2014 The target Spring Framework 6.2.1-tuxcare.6 is NOT AFFECTED by CVE-2013-7315. The vulnerable code pattern (XMLInputFactory created without disabling external entity resolution) is not present. The target uses StaxUtils.createDefensiveInputFactory() which provides comprehensive XXE protection by disabling DTD support, external entities, and setting a no-op XML resolver. This fix was authored by ...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@6.2.1-tuxcare.6"
    }
  ]
}