{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:0e419505-b3b3-57d4-80a7-039c4bd537c5",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "commons-compress",
      "purl": "pkg:maven/org.apache.commons/commons-compress@1.8.1-tuxcare.2",
      "type": "library",
      "group": "org.apache.commons",
      "bom-ref": "pkg:maven/org.apache.commons/commons-compress@1.8.1-tuxcare.2",
      "version": "1.8.1-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "commons-compress",
            "purl": "pkg:maven/org.apache.commons/commons-compress@1.8.1",
            "type": "library",
            "group": "org.apache.commons",
            "version": "1.8.1"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-11771",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.commons/commons-compress@1.8.1-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:33f728ac-4853-51d2-bd55-15bf51c1d028",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2018-11771 is fixed in version 1.8.1-tuxcare.2 of org.apache.commons:commons-compress."
      }
    },
    {
      "id": "CVE-2018-1324",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.commons/commons-compress@1.8.1-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ba627919-d279-5a85-a0b3-c3830f17e369",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1324 does not affect version 1.8.1-tuxcare.2 of org.apache.commons:commons-compress. not_affected \u2014 Apache Commons Compress version 1.8.1 is NOT AFFECTED by CVE-2018-1324. The vulnerable class X0017_StrongEncryptionHeader containing the integer overflow loop was introduced in version 1.11 (April 2016), nearly 2 years after version 1.8.1 was released (May 2014). The vulnerable code path does not exist in this version.",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2019-12402",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.commons/commons-compress@1.8.1-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:d8540e91-afee-5ad0-9db4-e09be0002f02",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-12402 affects version 1.8.1-tuxcare.2 of org.apache.commons:commons-compress."
      }
    },
    {
      "id": "CVE-2021-35515",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.commons/commons-compress@1.8.1-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:94450791-b01e-587b-9a55-1a3f2d21dc1e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2021-35515 is fixed in version 1.8.1-tuxcare.2 of org.apache.commons:commons-compress."
      }
    },
    {
      "id": "CVE-2021-35516",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.commons/commons-compress@1.8.1-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:e256331d-bf37-5c80-ab0e-d9a2f8a162f7",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-35516 affects version 1.8.1-tuxcare.2 of org.apache.commons:commons-compress."
      }
    },
    {
      "id": "CVE-2021-35517",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.commons/commons-compress@1.8.1-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:92b46113-bb4f-567f-9732-4340c89615e8",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-35517 affects version 1.8.1-tuxcare.2 of org.apache.commons:commons-compress."
      }
    },
    {
      "id": "CVE-2021-36090",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.commons/commons-compress@1.8.1-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:3c7d60c3-f352-53d0-a9b8-f37795529a76",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-36090 affects version 1.8.1-tuxcare.2 of org.apache.commons:commons-compress."
      }
    },
    {
      "id": "CVE-2023-42503",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.commons/commons-compress@1.8.1-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:94293ea0-da6d-5744-83a9-bf0abdbacbee",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-42503 does not affect version 1.8.1-tuxcare.2 of org.apache.commons:commons-compress. not_affected \u2014 Apache Commons Compress version 1.8.1 is NOT AFFECTED by CVE-2023-42503. The vulnerable code using BigDecimal for PAX extended header time parsing was introduced in version 1.22 (COMPRESS-612) and does not exist in version 1.8.1. Version 1.8.1 uses Double.parseDouble() for mtime parsing only, which lacks the algorithmic complexity vulnerability present in BigDecimal's arbitrary-precision arithm...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2024-25710",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.commons/commons-compress@1.8.1-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:1feb599b-0f30-5dbc-9ffc-a9897d868e6e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-25710 is fixed in version 1.8.1-tuxcare.2 of org.apache.commons:commons-compress."
      }
    },
    {
      "id": "CVE-2024-26308",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.commons/commons-compress@1.8.1-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:631b3417-268a-53a2-9a90-35d605e36c3d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-26308 does not affect version 1.8.1-tuxcare.2 of org.apache.commons:commons-compress. Prechecker: No vulnerable code from the fix was found, and none of the calls on the lines the fix removes appear in this version. Version 1.8.1 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-4265-ccf5-phj5 (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.commons/commons-compress@1.8.1-tuxcare.2"
    }
  ]
}