{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:3215d342-2939-5191-bd17-3e6fa545ba11",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@6.2.5-tuxcare.3",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@6.2.5-tuxcare.3",
      "version": "6.2.5-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@6.2.5",
            "type": "library",
            "group": "org.springframework",
            "version": "6.2.5"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@6.2.5-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:71e865f6-cbe9-5ea2-b11b-e427c6876437",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 6.2.5-tuxcare.3 of org.springframework:spring-oxm. not_affected \u2014 Spring Framework 6.2.5 is NOT affected by CVE-2013-4152 (XXE via unprotected XMLInputFactory in JAXB message converter). The vulnerability was fixed in upstream Spring Framework in 2013 (commit 7576274874), well before the 6.2.5 release. The target ships with comprehensive XXE protections via StaxUtils.createDefensiveInputFactory() that disable DTD support, external entity resolution, and use a...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@6.2.5-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:a32170ab-f9b2-56b9-a260-3c2e9be29a56",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 6.2.5-tuxcare.3 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-7315 is not present in Spring Framework 6.2.5. The XXE vulnerability in Jaxb2CollectionHttpMessageConverter was fixed by upstream Spring in July 2017 (commit e4651d6b50), and the fix was already present in the 6.2.5 release. The current implementation uses StaxUtils.createDefensiveInputFactory() which provides comprehensive XXE protection by disabling DTD support, external entities, an...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@6.2.5-tuxcare.3"
    }
  ]
}