{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:502e2abe-a51b-572a-8e70-ae55a564ae23",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "bookkeeper-common",
      "purl": "pkg:maven/org.apache.bookkeeper/bookkeeper-common@4.16.6-tuxcare.2",
      "type": "library",
      "group": "org.apache.bookkeeper",
      "bom-ref": "pkg:maven/org.apache.bookkeeper/bookkeeper-common@4.16.6-tuxcare.2",
      "version": "4.16.6-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "bookkeeper-common",
            "purl": "pkg:maven/org.apache.bookkeeper/bookkeeper-common@4.16.6",
            "type": "library",
            "group": "org.apache.bookkeeper",
            "version": "4.16.6"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2022-32531",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.bookkeeper/bookkeeper-common@4.16.6-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:e52d0448-aa0e-5dc7-bb81-43b815d29c99",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-32531 does not affect version 4.16.6-tuxcare.2 of org.apache.bookkeeper:bookkeeper-common. not_affected \u2014 CVE-2022-32531 is not present in Apache BookKeeper 4.16.6-tuxcare.2. The vulnerability, which allowed TLS connections to remain open when hostname verification failed, was fixed in upstream commit 6b22f852d3 (June 2022) by Michael Marshall. This fix was already included in the upstream Apache BookKeeper 4.16.6 release that TuxCare onboarded. The target contains the proper fix: hostname verifica...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.bookkeeper/bookkeeper-common@4.16.6-tuxcare.2"
    }
  ]
}