{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:bedfcf83-4833-51c1-8e73-35d4f11af952",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "logback-classic",
      "purl": "pkg:maven/ch.qos.logback/logback-classic@1.5.22-tuxcare.1",
      "type": "library",
      "group": "ch.qos.logback",
      "bom-ref": "pkg:maven/ch.qos.logback/logback-classic@1.5.22-tuxcare.1",
      "version": "1.5.22-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "logback-classic",
            "purl": "pkg:maven/ch.qos.logback/logback-classic@1.5.22",
            "type": "library",
            "group": "ch.qos.logback",
            "version": "1.5.22"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2017-5929",
      "affects": [
        {
          "ref": "pkg:maven/ch.qos.logback/logback-classic@1.5.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c6008d22-910a-5872-9c29-6e2ce67deaf0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-5929 does not affect version 1.5.22-tuxcare.1 of ch.qos.logback:logback-classic. CVE-2017-5929 affects Logback versions before 1.2.0 due to unsafe deserialization in SocketNode and RemoteAppenderStreamClient classes that used raw ObjectInputStream without validation, allowing arbitrary code execution via malicious serialized objects. The upstream fix (commit 7fbea6127) replaced ObjectInputStream with HardenedObjectInputStream, which implements whitelist-based class validation in resolveClass(). This fix shipped in Logback 1.2.0 and is present in version 1.5.22. All vulnerable components now use HardenedLoggingEventInputStream with a whitelist limited to legitimate Logback event classes. No raw ObjectInputStream usage found in socket-receiving code. Verdict: not_affected because the vulnerable pattern is not present - the upstream fix was already in the release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.2.0; < 1.2.0), NVD (< 1.2.0), Snyk (>= 0.3, < 1.2.0; >= 0.6, < 1.2.0; < 1.1.11).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-6378",
      "affects": [
        {
          "ref": "pkg:maven/ch.qos.logback/logback-classic@1.5.22-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:80d244f6-31d7-5495-9668-6f124406a271",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-6378 does not affect version 1.5.22-tuxcare.1 of ch.qos.logback:logback-classic. CVE-2023-6378 is not present in logback 1.5.22-tuxcare.1. The vulnerability concerns a denial-of-service attack via malicious serialized data in the logback receiver component. The upstream vendor (QOS.ch) fixed this vulnerability in November 2023 by adding (1) array length validation in LoggingEventVO.readObject() to reject negative or excessively large array allocations, and (2) global deserialization limits (max depth 16, max array size 10000) via ObjectInputFilter in HardenedObjectInputStream. These defenses are present in the target at LoggingEventVO.java:46,210-213 and HardenedObjectInputStream.java:43-44,57-61. The fix commit (9c782b45b) was authored by upstream maintainer Ceki Gulcu and was already included in upstream logback 1.5.22 before TuxCare onboarded this version. Therefore, the vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.3.0, < 1.3.12; >= 1.4.0, < 1.4.12; >= 1.3.0, < 1.3.12; >= 1.4.0, < 1.4.12; < 1.2.13; < 1.2.13), NVD (>= 1.2.0, < 1.2.13; >= 1.3.0, < 1.3.12; >= 1.4.0, < 1.4.12), Snyk (< 1.2.13; >= 1.3.0-alpha0, < 1.3.12; >= 1.4.0, < 1.4.12; < 1.2.13; >= 1.3.0-alpha0, < 1.3.12; >= 1.4.0, < 1.4.12).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/ch.qos.logback/logback-classic@1.5.22-tuxcare.1"
    }
  ]
}