{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:d2356572-01ff-515f-a9bc-a683350d99e7",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@6.2.13-tuxcare.4",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@6.2.13-tuxcare.4",
      "version": "6.2.13-tuxcare.4",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@6.2.13",
            "type": "library",
            "group": "org.springframework",
            "version": "6.2.13"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@6.2.13-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:778ccf3a-a2ad-5399-85d1-8244c94be8bd",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 6.2.13-tuxcare.4 of org.springframework:spring-oxm. not_affected \u2014 Target version 6.2.13 is not affected by CVE-2013-4152. The vulnerable XXE pattern is not present because upstream Spring Framework introduced comprehensive XXE defenses between 2013-2017, all of which were included in the upstream 6.2.13 release before TuxCare onboarded it. Specifically: (1) Jaxb2CollectionHttpMessageConverter uses StaxUtils.createDefensiveInputFactory() which disables DTD sup...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@6.2.13-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:d21e9002-3d0e-5e65-a2ef-38f79d8c9804",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 6.2.13-tuxcare.4 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-7315 (XXE vulnerability in Spring MVC's XMLInputFactory) is NOT present in this target. The upstream fix was committed in August 2013 (commit 7576274874) and shipped in Spring Framework 6.2.13, which TuxCare onboarded. The current code uses StaxUtils.createDefensiveInputFactory() providing comprehensive XXE protection: SUPPORT_DTD=false, IS_SUPPORTING_EXTERNAL_ENTITIES=false, and NO_OP...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@6.2.13-tuxcare.4"
    }
  ]
}