{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:eff4fd2d-59e8-555c-aa82-f52c0d285630",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "logback-classic",
      "purl": "pkg:maven/ch.qos.logback/logback-classic@1.2.12-tuxcare.2",
      "type": "library",
      "group": "ch.qos.logback",
      "bom-ref": "pkg:maven/ch.qos.logback/logback-classic@1.2.12-tuxcare.2",
      "version": "1.2.12-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "logback-classic",
            "purl": "pkg:maven/ch.qos.logback/logback-classic@1.2.12",
            "type": "library",
            "group": "ch.qos.logback",
            "version": "1.2.12"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2017-5929",
      "affects": [
        {
          "ref": "pkg:maven/ch.qos.logback/logback-classic@1.2.12-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:f27fb017-54fd-5aaf-b057-c91e5746b0d5",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-5929 does not affect version 1.2.12-tuxcare.2 of ch.qos.logback:logback-classic. The target (logback 1.2.12-tuxcare.2) is not affected by CVE-2017-5929. The upstream vendor (QOS.ch) fixed this deserialization vulnerability in version 1.2.0 by replacing all ObjectInputStream usage with HardenedObjectInputStream subclasses that enforce whitelist-based class filtering. The fix commit (f46044b805...) was already present in the upstream 1.2.12 release that TuxCare onboarded, as confirmed by git ancestry analysis showing the fix predates the first TuxCare commit (822fed60e \"Onboard version 1.2.12\"). All vulnerable components mentioned in the CVE (SocketNode classic/access, ServerSocketReceiver, RemoteAppenderStreamClient) now use hardened deserialization streams that reject unauthorized classes via InvalidClassException.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.2.0; < 1.2.0), NVD (< 1.2.0), Snyk (>= 0.3, < 1.2.0; >= 0.6, < 1.2.0; < 1.1.11).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-6378",
      "affects": [
        {
          "ref": "pkg:maven/ch.qos.logback/logback-classic@1.2.12-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:86ca4d46-59bd-525c-b1d5-333d3723816e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-6378 affects version 1.2.12-tuxcare.2 of ch.qos.logback:logback-classic."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/ch.qos.logback/logback-classic@1.2.12-tuxcare.2"
    }
  ]
}