{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:cf4e4201-ebbf-50bd-9cbc-e2e3ea937b47",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "activemq-jaas",
      "purl": "pkg:maven/org.apache.activemq/activemq-jaas@6.1.8-tuxcare.2",
      "type": "library",
      "group": "org.apache.activemq",
      "bom-ref": "pkg:maven/org.apache.activemq/activemq-jaas@6.1.8-tuxcare.2",
      "version": "6.1.8-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "activemq-jaas",
            "purl": "pkg:maven/org.apache.activemq/activemq-jaas@6.1.8",
            "type": "library",
            "group": "org.apache.activemq",
            "version": "6.1.8"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2014-3612",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/activemq-jaas@6.1.8-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:9d3cad23-f5ab-5dac-9543-7e6a1add3740",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2014-3612 does not affect version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-jaas. CVE-2014-3612 (LDAP authentication bypass via empty password) is NOT present in this Apache ActiveMQ 6.1.8 target. The upstream vendor fix (commit 0b5231ada from 2014-09-08, AMQ-5345) was already included in the Apache ActiveMQ 6.1.8 release that TuxCare onboarded. The vulnerable code pattern allowing empty passwords in LDAP bind operations has been replaced with explicit validation that rejects empty username or password values.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0, < 5.10.1; >= 5.0.0, < 5.10.1), NVD (= 5.0.0; = 5.1.0; = 5.2.0; = 5.3.0; = 5.3.1; = 5.3.2; = 5.4.0; = 5.4.1; = 5.4.2; = 5.4.3; = 5.5.0; = 5.5.1; = 5.6.0; = 5.7.0; = 5.8.0; = 5.9.0; = 5.9.1; = 5.10.0), Snyk (>= 5.0.0, < 5.10.1; >= 5.0.0, < 5.10.1; <= 0; >= 5.0.0, < 5.10.1; <= 0).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2015-6524",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/activemq-jaas@6.1.8-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:79b30d45-8e8b-5def-82f4-47815d2394b7",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2015-6524 does not affect version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-jaas. not_affected \u2014 CVE-2015-6524 is NOT present in target ActiveMQ 6.1.8. The vulnerability (LDAP filter injection via unencoded usernames allowing wildcard brute force attacks) was fixed in upstream commit 0b5231ada (AMQ-5345) dated 2014-09-08, which was already included in the upstream ActiveMQ 6.1.8 release when TuxCare onboarded it on 2026-07-22. The fix applies RFC 2254 encoding to usernames before LDAP filt...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.activemq/activemq-jaas@6.1.8-tuxcare.2"
    }
  ]
}