{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:ce893988-f127-57b5-9df9-f9600065dd08",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "numpy",
      "purl": "pkg:pypi/numpy@1.21.6.post1+tuxcare",
      "type": "library",
      "bom-ref": "pkg:pypi/numpy@1.21.6.post1+tuxcare",
      "version": "1.21.6.post1+tuxcare",
      "pedigree": {
        "ancestors": [
          {
            "name": "numpy",
            "purl": "pkg:pypi/numpy@1.21.6",
            "type": "library",
            "version": "1.21.6"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2014-1858",
      "affects": [
        {
          "ref": "pkg:pypi/numpy@1.21.6.post1+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:9214f346-c57a-5807-bd02-4f5d6a8a9647",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2014-1858 does not affect version 1.21.6.post1+tuxcare of numpy. Insecure tempfile.mktemp() in f2py was removed in numpy 1.8.1 (0bb46c1448); no mktemp() calls remain in numpy/f2py or numpy/distutils of v1.21.6. Verified by hand (PYELS-212).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2014-1859",
      "affects": [
        {
          "ref": "pkg:pypi/numpy@1.21.6.post1+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:dfa6b547-d055-5a33-a375-ec31265c7b97",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2014-1859 does not affect version 1.21.6.post1+tuxcare of numpy. Insecure tempfile.mktemp() usage was removed in numpy 1.8.1 (0bb46c1448); no mktemp() calls remain in numpy/f2py or numpy/distutils of v1.21.6. Verified by hand (PYELS-212).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2017-12852",
      "affects": [
        {
          "ref": "pkg:pypi/numpy@1.21.6.post1+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:357d2bb0-9400-5a92-90ff-8725aca2b3aa",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-12852 does not affect version 1.21.6.post1+tuxcare of numpy. The numpy.pad infinite loop on empty arrays was fixed in 1.13.2; v1.21.6 numpy/lib/arraypad.py raises \"can't extend empty axis ... using modes other than constant or empty\" instead of looping. Verified by hand (PYELS-212).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2019-6446",
      "affects": [
        {
          "ref": "pkg:pypi/numpy@1.21.6.post1+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:e2c58a24-20ec-513c-9e9e-304a01ce76bd",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-6446 does not affect version 1.21.6.post1+tuxcare of numpy. numpy.load() defaults to allow_pickle=False since 1.16.3 (a4df7e51); v1.21.6 keeps that default, so unpickling untrusted data requires the caller to opt in explicitly. Verified by hand (PYELS-212).",
        "justification": "requires_configuration"
      }
    },
    {
      "id": "CVE-2021-33430",
      "affects": [
        {
          "ref": "pkg:pypi/numpy@1.21.6.post1+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:f3f0b527-1b1f-5eb6-bcc5-4d18106b0722",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-33430 does not affect version 1.21.6.post1+tuxcare of numpy. Upstream fix 16f7824b4d (dimension validation in PyArray_NewFromDescr_int before subarray handling, numpy 1.21.0) is an ancestor of v1.21.6. Verified by hand (PYELS-212).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-34141",
      "affects": [
        {
          "ref": "pkg:pypi/numpy@1.21.6.post1+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:399f4f2f-d68e-5582-ace6-33ee4a76c98f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2021-34141 is fixed in version 1.21.6.post1+tuxcare of numpy."
      }
    },
    {
      "id": "CVE-2021-41495",
      "affects": [
        {
          "ref": "pkg:pypi/numpy@1.21.6.post1+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:8a8bfcd6-2109-5f7a-841f-d3f3365f5b6d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2021-41495 is fixed in version 1.21.6.post1+tuxcare of numpy."
      }
    },
    {
      "id": "CVE-2021-41496",
      "affects": [
        {
          "ref": "pkg:pypi/numpy@1.21.6.post1+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:aae26894-4198-5504-a93d-d05a7d2260c5",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2021-41496 is fixed in version 1.21.6.post1+tuxcare of numpy."
      }
    },
    {
      "id": "TUXVUL-2026-10004",
      "affects": [
        {
          "ref": "pkg:pypi/numpy@1.21.6.post1+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:27a38f33-39e1-546d-8092-955ed858853e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability TUXVUL-2026-10004 is fixed in version 1.21.6.post1+tuxcare of numpy."
      }
    },
    {
      "id": "TUXVUL-2026-10006",
      "affects": [
        {
          "ref": "pkg:pypi/numpy@1.21.6.post1+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:de2982b6-0a04-5ad9-833a-364700d914f8",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability TUXVUL-2026-10006 is fixed in version 1.21.6.post1+tuxcare of numpy."
      }
    },
    {
      "id": "TUXVUL-2026-10007",
      "affects": [
        {
          "ref": "pkg:pypi/numpy@1.21.6.post1+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:d75b9fd1-8cc4-5d02-bd0f-720060f5b5dd",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability TUXVUL-2026-10007 is fixed in version 1.21.6.post1+tuxcare of numpy."
      }
    },
    {
      "id": "TUXVUL-2026-10008",
      "affects": [
        {
          "ref": "pkg:pypi/numpy@1.21.6.post1+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:96549489-b27b-5339-b122-e1c7b7f068ec",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability TUXVUL-2026-10008 is fixed in version 1.21.6.post1+tuxcare of numpy."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:pypi/numpy@1.21.6.post1+tuxcare"
    }
  ]
}