{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:37403860-d6b4-58be-801c-baef75fa3aa2",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "jackson-dataformat-xml",
      "purl": "pkg:maven/com.fasterxml.jackson.dataformat/jackson-dataformat-xml@2.10.0-tuxcare.2",
      "type": "library",
      "group": "com.fasterxml.jackson.dataformat",
      "bom-ref": "pkg:maven/com.fasterxml.jackson.dataformat/jackson-dataformat-xml@2.10.0-tuxcare.2",
      "version": "2.10.0-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "jackson-dataformat-xml",
            "purl": "pkg:maven/com.fasterxml.jackson.dataformat/jackson-dataformat-xml@2.10.0",
            "type": "library",
            "group": "com.fasterxml.jackson.dataformat",
            "version": "2.10.0"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2016-3720",
      "affects": [
        {
          "ref": "pkg:maven/com.fasterxml.jackson.dataformat/jackson-dataformat-xml@2.10.0-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:d5aab5fe-415d-5d02-ad4a-82a34b5519b7",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-3720 does not affect version 2.10.0-tuxcare.2 of com.fasterxml.jackson.dataformat:jackson-dataformat-xml. CVE-2016-3720 (XXE vulnerability) is NOT present in jackson-dataformat-xml 2.10.0. The upstream fix that disables external entity processing by default was already included in the upstream 2.10.0 release when TuxCare onboarded it. The defense code at XmlFactory.java:115 sets IS_SUPPORTING_EXTERNAL_ENTITIES to FALSE, preventing XXE attacks. Fix authored by Tatu Saloranta (tatu.saloranta@iki.fi), the upstream Jackson maintainer, and shipped in upstream release 2.10.0 before TuxCare's onboarding commit aaa1bf09.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.4), NVD (<= 2.7.3), Snyk (>= 2.0.0, < 2.7.4).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2016-7051",
      "affects": [
        {
          "ref": "pkg:maven/com.fasterxml.jackson.dataformat/jackson-dataformat-xml@2.10.0-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:41d36105-6685-58a3-8762-946f0c1c841a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2016-7051 does not affect version 2.10.0-tuxcare.2 of com.fasterxml.jackson.dataformat:jackson-dataformat-xml. Target version 2.10.0 is not affected by CVE-2016-7051 (DTD-based SSRF). The vulnerability was fixed by upstream maintainer Tatu Saloranta in version 2.7.8 (commit eeff2c31) by disabling DTD support via XMLInputFactory.SUPPORT_DTD = Boolean.FALSE. This fix was already present in the upstream 2.10.0 release that TuxCare onboarded, making the target immune to the attack vector. The vulnerable pattern does not exist in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.8; >= 2.8.0, < 2.8.4), NVD (< 2.7.8; = 2.8.0; = 2.8.0-rc1; = 2.8.0-rc2; = 2.8.1; = 2.8.2; = 2.8.3), Snyk (>= 2.7.4, < 2.7.8; >= 2.8.0, <= 2.8.4).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/com.fasterxml.jackson.dataformat/jackson-dataformat-xml@2.10.0-tuxcare.2"
    }
  ]
}