{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:6fc5709b-f924-5e29-81f5-31ca3f5a2296",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "artemis-commons",
      "purl": "pkg:maven/org.apache.activemq/artemis-commons@2.40.0-tuxcare.4",
      "type": "library",
      "group": "org.apache.activemq",
      "bom-ref": "pkg:maven/org.apache.activemq/artemis-commons@2.40.0-tuxcare.4",
      "version": "2.40.0-tuxcare.4",
      "pedigree": {
        "ancestors": [
          {
            "name": "artemis-commons",
            "purl": "pkg:maven/org.apache.activemq/artemis-commons@2.40.0",
            "type": "library",
            "group": "org.apache.activemq",
            "version": "2.40.0"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2020-10727",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/artemis-commons@2.40.0-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:bd4288db-5a75-5a58-95d8-96c5187dbe8b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-10727 does not affect version 2.40.0-tuxcare.4 of org.apache.activemq:artemis-commons. not_affected \u2014 The target is not affected by CVE-2020-10727. The vulnerability (lack of password hashing capability in the resetUser management API operation) was fixed in the upstream Apache Artemis release. The fix (commit ed7fee6d9c by Justin Bertram) was already present in version 2.40.0 when TuxCare onboarded it. The target now includes both resetUser() methods: the original 3-parameter version (backward...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.activemq/artemis-commons@2.40.0-tuxcare.4"
    }
  ]
}