{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:7ec7bc04-b0b3-5367-9e52-f3780001161e",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "retrofit",
      "purl": "pkg:maven/com.squareup.retrofit2/retrofit@2.9.0-tuxcare.2",
      "type": "library",
      "group": "com.squareup.retrofit2",
      "bom-ref": "pkg:maven/com.squareup.retrofit2/retrofit@2.9.0-tuxcare.2",
      "version": "2.9.0-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "retrofit",
            "purl": "pkg:maven/com.squareup.retrofit2/retrofit@2.9.0",
            "type": "library",
            "group": "com.squareup.retrofit2",
            "version": "2.9.0"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1000844",
      "affects": [
        {
          "ref": "pkg:maven/com.squareup.retrofit2/retrofit@2.9.0-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:0a5ac245-a6ac-5b4c-b772-b9a57d19082d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1000844 does not affect version 2.9.0-tuxcare.2 of com.squareup.retrofit2:retrofit. The target repository (Retrofit 2.9.0-tuxcare.2) is not affected by CVE-2018-1000844. The XXE vulnerability fix was applied by the upstream vendor (Square) in commit 4a693c5aeeef2be6c7ecf80e7b5ec79f6ab59437 on April 17, 2018, more than 2 years before Retrofit version 2.9.0 was released (May 20, 2020). The fix disables external entity processing and DTD support in the JAXB converter by setting two XMLInputFactory properties to false. When TuxCare onboarded version 2.9.0, this fix was already present in the upstream codebase, so the vulnerable code pattern was never present in the TuxCare-maintained version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.5.0), NVD (>= 2.4.0, < 2.5.0), Snyk (< 2.5.0).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1000850",
      "affects": [
        {
          "ref": "pkg:maven/com.squareup.retrofit2/retrofit@2.9.0-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:5bcfb72c-c689-5af7-8121-78eb895ee5f8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1000850 does not affect version 2.9.0-tuxcare.2 of com.squareup.retrofit2:retrofit. CVE-2018-1000850 affects Retrofit 2.0 to 2.5.0 (excluding). The target is Retrofit 2.9.0, which already contains the upstream fix (commit b9a7f6ad by Jesse Wilson) that validates path parameters to prevent directory traversal attacks. The fix was shipped in the upstream 2.9.0 release before TuxCare onboarded it, making the vulnerable pattern absent from this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.5.0), NVD (>= 2.0.0, < 2.5.0), Snyk (>= 2.0.0, < 2.5.0).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/com.squareup.retrofit2/retrofit@2.9.0-tuxcare.2"
    }
  ]
}