{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:3066e823-34eb-50c1-bfe1-3d9c517d85e2",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "micronaut-http-server-netty",
      "purl": "pkg:maven/io.micronaut/micronaut-http-server-netty@3.8.4-tuxcare.1",
      "type": "library",
      "group": "io.micronaut",
      "bom-ref": "pkg:maven/io.micronaut/micronaut-http-server-netty@3.8.4-tuxcare.1",
      "version": "3.8.4-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "micronaut-http-server-netty",
            "purl": "pkg:maven/io.micronaut/micronaut-http-server-netty@3.8.4",
            "type": "library",
            "group": "io.micronaut",
            "version": "3.8.4"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2021-32769",
      "affects": [
        {
          "ref": "pkg:maven/io.micronaut/micronaut-http-server-netty@3.8.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a0597bff-4545-5b7f-8ae2-14a844a92909",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-32769 does not affect version 3.8.4-tuxcare.1 of io.micronaut:micronaut-http-server-netty. not_affected \u2014 The target is not affected by CVE-2021-32769. The path traversal vulnerability was already fixed in upstream Micronaut 3.8.4 (commit a0cfeb13bf from July 14, 2021) before TuxCare onboarded this version. The fix introduces path containment validation at DefaultFileSystemResourceLoader.BaseDir.startsWith() (lines 181-192), which canonicalizes resolved paths via toRealPath() and checks they remain...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-23639",
      "affects": [
        {
          "ref": "pkg:maven/io.micronaut/micronaut-http-server-netty@3.8.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:7a903d60-b07e-52cb-9e01-b1ceaba0fad9",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-23639 does not affect version 3.8.4-tuxcare.1 of io.micronaut:micronaut-http-server-netty. not_affected \u2014 The target repository (micronaut-core 3.8.4) is NOT AFFECTED by CVE-2024-23639. All three upstream patches that fix the drive-by localhost CORS vulnerability are present in the codebase. The fixes were authored by upstream Micronaut developers (Tim Yates, Sergio del Amo) and were already included in the upstream 3.8.4 release that TuxCare onboarded. The defense logic blocks HTTP requests where ...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/io.micronaut/micronaut-http-server-netty@3.8.4-tuxcare.1"
    }
  ]
}