{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:abd41ed2-1271-50b4-a344-17cf7521f1cf",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-oxm",
      "purl": "pkg:maven/org.springframework/spring-oxm@6.2.7-tuxcare.2",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-oxm@6.2.7-tuxcare.2",
      "version": "6.2.7-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-oxm",
            "purl": "pkg:maven/org.springframework/spring-oxm@6.2.7",
            "type": "library",
            "group": "org.springframework",
            "version": "6.2.7"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2013-4152",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@6.2.7-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:73a74558-f0ec-5220-8b3c-cadb45836f6c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-4152 does not affect version 6.2.7-tuxcare.2 of org.springframework:spring-oxm. not_affected \u2014 Spring Framework 6.2.7 is not affected by CVE-2013-4152. The vulnerable XXE pattern described in the CVE has been removed by comprehensive upstream fixes that were already present in the 6.2.7 release. The target uses StaxUtils.createDefensiveInputFactory() which disables DTD processing (SUPPORT_DTD=false), external entity resolution (IS_SUPPORTING_EXTERNAL_ENTITIES=false), and installs a no-op...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2013-7315",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-oxm@6.2.7-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:569b2d79-f132-5315-804e-ba74c8eb6e6f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2013-7315 does not affect version 6.2.7-tuxcare.2 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-7315 describes an XXE vulnerability in Spring Framework's Jaxb2CollectionHttpMessageConverter that allowed external entity resolution via crafted XML. The target repository (Spring Framework 6.2.7-tuxcare.2) is NOT AFFECTED because the fix was already present in the upstream Spring 6.2.7 release when TuxCare onboarded it. The original upstream fix (commit 7576274874, August 2013) was a...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-oxm@6.2.7-tuxcare.2"
    }
  ]
}