{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:d912e68c-fc87-545a-a8c8-b2c4203d2656",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "wildfly-elytron",
      "purl": "pkg:maven/org.wildfly.security/wildfly-elytron@1.12.1.Final-tuxcare.1",
      "type": "library",
      "group": "org.wildfly.security",
      "bom-ref": "pkg:maven/org.wildfly.security/wildfly-elytron@1.12.1.Final-tuxcare.1",
      "version": "1.12.1.Final-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "wildfly-elytron",
            "purl": "pkg:maven/org.wildfly.security/wildfly-elytron@1.12.1.Final",
            "type": "library",
            "group": "org.wildfly.security",
            "version": "1.12.1.Final"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2015-5186",
      "affects": [
        {
          "ref": "pkg:maven/org.wildfly.security/wildfly-elytron@1.12.1.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8b6a5ab5-a5b8-58dc-a0d3-cee42b5f546a",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2015-5186 is a false positive for org.wildfly.security:wildfly-elytron 1.12.1.Final-tuxcare.1. false_positive \u2014 CVE-2015-5186 concerns the Linux Audit subsystem (auditd/libaudit) version < 2.4.4, a C-based Linux kernel/userspace component that logs system calls and security events at the OS level. The target repository is WildFly Elytron 1.12.1.Final, a Java-based security framework for authentication and authorization. This is a wrong-project match caused by both projects using the term \"audit\" in their..."
      }
    },
    {
      "id": "CVE-2020-10714",
      "affects": [
        {
          "ref": "pkg:maven/org.wildfly.security/wildfly-elytron@1.12.1.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b1c4f713-a0f8-59c7-94cc-792ea4b341ac",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-10714 does not affect version 1.12.1.Final-tuxcare.1 of org.wildfly.security:wildfly-elytron. Target repository version 1.12.1.Final is not affected by CVE-2020-10714. The CVE affects WildFly Elytron \"version 1.11.3.Final and before\" for a session fixation vulnerability in FORM authentication. All upstream security fixes (ELY-1950 and ELY-1945) were applied in April 2020 by upstream author Darran Lofthouse and shipped in the 1.12.1.Final release (June 2020). TuxCare onboarded this already-patched version. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.11.4), NVD (< 1.11.3), cve.org (= 1.10.7.Final), Snyk (< 1.6.7.Final; >= 1.7.0.CR1, < 1.11.4.Final).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-1748",
      "affects": [
        {
          "ref": "pkg:maven/org.wildfly.security/wildfly-elytron@1.12.1.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:77e3144e-f842-5ff6-ba20-8ab408a82411",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2020-1748 is fixed in version 1.12.1.Final-tuxcare.1 of org.wildfly.security:wildfly-elytron."
      }
    },
    {
      "id": "CVE-2021-3642",
      "affects": [
        {
          "ref": "pkg:maven/org.wildfly.security/wildfly-elytron@1.12.1.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:527e97a5-b75e-56af-b7e6-514661391ce9",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-3642 affects version 1.12.1.Final-tuxcare.1 of org.wildfly.security:wildfly-elytron."
      }
    },
    {
      "id": "CVE-2022-3143",
      "affects": [
        {
          "ref": "pkg:maven/org.wildfly.security/wildfly-elytron@1.12.1.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:39ec3549-5747-5a2c-bfb1-e4d7c06a7c8f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-3143 affects version 1.12.1.Final-tuxcare.1 of org.wildfly.security:wildfly-elytron."
      }
    },
    {
      "id": "CVE-2024-12369",
      "affects": [
        {
          "ref": "pkg:maven/org.wildfly.security/wildfly-elytron@1.12.1.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9f362d2d-36ce-50cf-a68e-735c7a54f8e3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-12369 does not affect version 1.12.1.Final-tuxcare.1 of org.wildfly.security:wildfly-elytron. not_affected \u2014 Target version 1.12.1.Final is NOT AFFECTED by CVE-2024-12369. The vulnerability affects the OIDC (OpenID Connect) client module in wildfly-elytron, but this module does not exist in version 1.12.1.Final. The OIDC client functionality was first introduced in version 1.15.7.Final, which is 4 minor versions later than the target. Since the vulnerable component (http/oidc module and all OIDC autho...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.wildfly.security/wildfly-elytron@1.12.1.Final-tuxcare.1"
    }
  ]
}