{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:2dddd01d-f378-59b4-82fb-82d7b028e96a",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "logback-core",
      "purl": "pkg:maven/ch.qos.logback/logback-core@1.2.3-tuxcare.3",
      "type": "library",
      "group": "ch.qos.logback",
      "bom-ref": "pkg:maven/ch.qos.logback/logback-core@1.2.3-tuxcare.3",
      "version": "1.2.3-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "logback-core",
            "purl": "pkg:maven/ch.qos.logback/logback-core@1.2.3",
            "type": "library",
            "group": "ch.qos.logback",
            "version": "1.2.3"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2017-5929",
      "affects": [
        {
          "ref": "pkg:maven/ch.qos.logback/logback-core@1.2.3-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:2bcdb666-cf33-5beb-adda-a4071399db29",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-5929 does not affect version 1.2.3-tuxcare.3 of ch.qos.logback:logback-core. CVE-2017-5929 affects Logback versions before 1.2.0. The target version 1.2.3 already includes the upstream fix (HardenedObjectInputStream with whitelist validation) that was introduced by upstream maintainer Ceki Gulcu in commit f46044b8. The fix was shipped in the upstream release 1.2.3 that TuxCare onboarded. All socket deserialization entry points (SocketNode, RemoteAppenderStreamClient, SocketReceiver) use the hardened streams with class name whitelist validation in resolveClass(), preventing arbitrary class instantiation during deserialization. No raw ObjectInputStream usage found in production code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.2.0; < 1.2.0), NVD (< 1.2.0), Snyk (>= 0.3, < 1.2.0; >= 0.6, < 1.2.0; < 1.1.11).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-42550",
      "affects": [
        {
          "ref": "pkg:maven/ch.qos.logback/logback-core@1.2.3-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:421c5651-7f98-5273-a8fb-7dee462b28f9",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-42550 affects version 1.2.3-tuxcare.3 of ch.qos.logback:logback-core."
      }
    },
    {
      "id": "CVE-2023-6378",
      "affects": [
        {
          "ref": "pkg:maven/ch.qos.logback/logback-core@1.2.3-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:cf6913d9-8681-5630-aa6c-effc3d9fa80a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-6378 affects version 1.2.3-tuxcare.3 of ch.qos.logback:logback-core."
      }
    },
    {
      "id": "CVE-2023-6481",
      "affects": [
        {
          "ref": "pkg:maven/ch.qos.logback/logback-core@1.2.3-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:858e73c9-8527-5f6b-a375-fb5dae27c8ac",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-6481 affects version 1.2.3-tuxcare.3 of ch.qos.logback:logback-core."
      }
    },
    {
      "id": "CVE-2024-12798",
      "affects": [
        {
          "ref": "pkg:maven/ch.qos.logback/logback-core@1.2.3-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:8d5f20e1-239e-50d0-b0f8-1ddf593f8adc",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-12798 is fixed in version 1.2.3-tuxcare.3 of ch.qos.logback:logback-core."
      }
    },
    {
      "id": "CVE-2024-12801",
      "affects": [
        {
          "ref": "pkg:maven/ch.qos.logback/logback-core@1.2.3-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:7f98fd33-4ca5-50e6-ad1c-657a05cf2eee",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-12801 is fixed in version 1.2.3-tuxcare.3 of ch.qos.logback:logback-core."
      }
    },
    {
      "id": "CVE-2025-11226",
      "affects": [
        {
          "ref": "pkg:maven/ch.qos.logback/logback-core@1.2.3-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:257c3892-26b2-556f-983f-162fd49a4a71",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-11226 is fixed in version 1.2.3-tuxcare.3 of ch.qos.logback:logback-core."
      }
    },
    {
      "id": "CVE-2026-10532",
      "affects": [
        {
          "ref": "pkg:maven/ch.qos.logback/logback-core@1.2.3-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:4645ac6e-b36c-5b81-9e27-a85a9f96aaf4",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-10532 is fixed in version 1.2.3-tuxcare.3 of ch.qos.logback:logback-core."
      }
    },
    {
      "id": "CVE-2026-1225",
      "affects": [
        {
          "ref": "pkg:maven/ch.qos.logback/logback-core@1.2.3-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:dcbe9b62-7b02-528f-b872-965179938018",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-1225 is fixed in version 1.2.3-tuxcare.3 of ch.qos.logback:logback-core."
      }
    },
    {
      "id": "CVE-2026-9828",
      "affects": [
        {
          "ref": "pkg:maven/ch.qos.logback/logback-core@1.2.3-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:03a710ea-9e2b-5f1b-a088-6120edc2e409",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-9828 affects version 1.2.3-tuxcare.3 of ch.qos.logback:logback-core."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/ch.qos.logback/logback-core@1.2.3-tuxcare.3"
    }
  ]
}