{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:ffc3c0e1-4eff-5268-94eb-af95bc1f0b8f",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "wildfly-elytron",
      "purl": "pkg:maven/org.wildfly.security/wildfly-elytron@1.1.0.Final-tuxcare.1",
      "type": "library",
      "group": "org.wildfly.security",
      "bom-ref": "pkg:maven/org.wildfly.security/wildfly-elytron@1.1.0.Final-tuxcare.1",
      "version": "1.1.0.Final-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "wildfly-elytron",
            "purl": "pkg:maven/org.wildfly.security/wildfly-elytron@1.1.0.Final",
            "type": "library",
            "group": "org.wildfly.security",
            "version": "1.1.0.Final"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2019-14843",
      "affects": [
        {
          "ref": "pkg:maven/org.wildfly.security/wildfly-elytron@1.1.0.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:cbfb8521-a8d1-548f-881a-c307af237096",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-14843 affects version 1.1.0.Final-tuxcare.1 of org.wildfly.security:wildfly-elytron."
      }
    },
    {
      "id": "CVE-2020-10714",
      "affects": [
        {
          "ref": "pkg:maven/org.wildfly.security/wildfly-elytron@1.1.0.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8304df16-104d-58a9-b245-2ba4930500a6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-10714 affects version 1.1.0.Final-tuxcare.1 of org.wildfly.security:wildfly-elytron."
      }
    },
    {
      "id": "CVE-2020-1748",
      "affects": [
        {
          "ref": "pkg:maven/org.wildfly.security/wildfly-elytron@1.1.0.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:926c0104-aba4-553d-ba96-0d35ff90ed3d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2020-1748 is fixed in version 1.1.0.Final-tuxcare.1 of org.wildfly.security:wildfly-elytron."
      }
    },
    {
      "id": "CVE-2021-3642",
      "affects": [
        {
          "ref": "pkg:maven/org.wildfly.security/wildfly-elytron@1.1.0.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:65013684-7f52-518e-9e8c-3dc5acc533fc",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2021-3642 is fixed in version 1.1.0.Final-tuxcare.1 of org.wildfly.security:wildfly-elytron."
      }
    },
    {
      "id": "CVE-2022-3143",
      "affects": [
        {
          "ref": "pkg:maven/org.wildfly.security/wildfly-elytron@1.1.0.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:acd630ce-b33e-51d5-b4b2-e0223f0f5462",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-3143 is fixed in version 1.1.0.Final-tuxcare.1 of org.wildfly.security:wildfly-elytron."
      }
    },
    {
      "id": "CVE-2024-12369",
      "affects": [
        {
          "ref": "pkg:maven/org.wildfly.security/wildfly-elytron@1.1.0.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:600079da-9f60-5411-89bd-ab95e8ab7668",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-12369 does not affect version 1.1.0.Final-tuxcare.1 of org.wildfly.security:wildfly-elytron. not_affected \u2014 Version 1.1.0.Final is not affected by CVE-2024-12369. This version does not contain the OIDC (OpenID Connect) client HTTP authentication mechanism that is vulnerable to authorization code injection attacks. The OIDC client feature, which receives authorization codes via HTTP redirect callbacks and exchanges them for tokens, was introduced in later versions (2.x series) of wildfly-elytron. Vers...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.wildfly.security/wildfly-elytron@1.1.0.Final-tuxcare.1"
    }
  ]
}